The latest minor release of a major version is supported with necessary security updates. When breaking changes occur, the previous major version will be supported for 90 days.

Please contact: [email protected] with the details of the vulnerability.

We will aim to get back to you within 48 hours. If you have received no contact from us within 30 days, please consider the vulnerability declined. If the vulnerability is accepted, we will aim to get a new minor release, depending on developer availability and technical complexity.

Unfortunately we're not able to offer a bounty at this time.