Security fixes target main and the latest tagged release, when one exists. Older tags are not maintained. Include the exact tag or commit in a report.

Report privately through GitHub private vulnerability reporting. Do not publish a suspected vulnerability in an issue or pull request.

Include reproduction steps, expected and observed behavior, the affected platform and version, and the possible impact. Remove credentials and other sensitive data from examples.

CoreTrace Logger is a logging library. Reports about memory safety, thread safety or sink handling should include the relevant configuration and a minimal reproducer.