We follow a rolling-release model: the latest main is supported. For the flagship projects (Surypus, package-maximizer, Magazine, integral-philosophy) released versions receive security fixes for 12 months.

Do not open a public issue for vulnerabilities.

Please report privately:

• GitHub Security Advisories: use "Report a vulnerability" on the Security tab
• or email the maintainer via the profile contact

We aim to acknowledge within 72h and provide a fix or mitigation plan within 14 days.