Security fixes are applied to the latest released 1.x version.

Please do not report security vulnerabilities in public issues or Discussions. Use GitHub's private vulnerability reporting for this repository. Include a minimal reproduction, affected version, impact, and any suggested mitigation.

We will acknowledge reports within seven days, assess impact, and coordinate a fix and disclosure timeline with the reporter.

Never include API keys, private transcripts, or source recordings in a report.