Please do not open a public issue. Report it privately through GitHub: Security tab → Report a vulnerability (private vulnerability reporting). Include steps to reproduce, impact, and affected versions or commits.

You can expect an acknowledgement within 7 days. We'll keep you updated on the fix and credit you in the advisory unless you prefer otherwise.

Only the latest main is supported until versioned releases exist.

Of particular interest: cross-store data access (tenant isolation), authentication/session handling, authorization bypasses, and exposure of secrets or personal data.