Security reports should be submitted privately through GitHub's security advisory interface for getbible/sword.

Please include:

• extension, PHP, getBibleSword, and operating-system versions;
• NTS or ZTS mode;
• module driver and module provenance;
• a minimized reproducer when licensing permits;
• sanitizer or debugger output; and
• whether the failure is reproducible with the standalone getBibleSword CLI.

Do not include confidential or non-redistributable module data in a public issue.

Only the latest released minor version receives security fixes until a broader support policy is published.