Security fixes are made on the current main branch. Please use the latest version from that branch.

Do not open a public issue for an unpatched vulnerability. Email procoderji@gmail.com with the affected route or component, the impact, and steps to reproduce. Do not include real user data or secrets in the report.

The maintainer will acknowledge the report, investigate it and coordinate a fix before public disclosure. There is no bug bounty program at this time.

Run npm audit before a release or dependency update. Review advisories and compatible fixes; avoid force-upgrading or downgrading unrelated packages to silence an audit finding.