Security fixes go to the latest minor release only.

Report privately through GitHub Security Advisories, not in a public issue, with steps to reproduce and the impact you see. Response is best effort, with no fixed times, and we coordinate disclosure with you. There is no bug bounty; with your permission, we credit you in the release notes.

Behavior documented under Limits is not a vulnerability. In short: anyone who can write to your Redis can forge cached values, keys up to 64 bytes hold arguments in clear, and DebugHandler has no authentication.

CI runs govulncheck and golangci-lint with gosec. Dependabot keeps dependencies current.