This project's full security model — what's protected, what's deliberately out of scope, and why — is documented in the wiki:
Please open a GitHub issue describing the concern. For anything sensitive enough that you'd rather not post publicly first, mention that in the issue title and details can follow privately.
This project doesn't maintain multiple release branches — only the latest
commit on main receives fixes. See Updating
for how to stay current.