Security fixes are focused on the actively developed version of this project.

Because the project is under active development, older versions may not receive security fixes.

Please do not disclose an unpatched security vulnerability in a public issue.

Report security issues privately through the repository's available GitHub security reporting mechanism, or contact the maintainers privately through GitHub.

Include a clear description, affected version or commit, reproduction steps, expected and actual behavior, and relevant logs or proof of concept when appropriate.

Do not include passwords, access tokens, private keys, personal information, or other sensitive data in a report.

Reports may cover the compiler, runtime, VM, native compiler, backend, IR handling, code generation, linker integration, and project tooling.

Third-party components remain governed by their own security processes and licenses. See Third_Party.md.

Please allow the maintainers reasonable time to investigate and address a reported vulnerability before public disclosure.

Not every bug is a security vulnerability. Reports are reviewed based on their actual impact and reproducibility.