Security fixes target the latest published stable release and the development branch. Older releases do not receive separate backports; update to the latest release. Pre-release builds are for testing. Support is best effort, with no guaranteed response time, fix deadline, or paid bug bounty.

Use GitHub's Report a vulnerability form. Do not publish an issue or pull request containing exploit details or secrets. Include the affected version, operating system, impact, and minimal reproduction steps using synthetic data. Never attach real usage logs, credentials, private project names, or customer data.

The maintainer will triage the report, discuss a fix privately, and coordinate public disclosure and reporter credit with you. Please allow time for a fix before publishing details. If the form is unavailable, open an issue asking for a private security contact without including vulnerability details.

Report ordinary bugs through the bug-report issue form. Report vulnerabilities in upstream dependencies to their maintainers too, and tell us privately if Tokenlens is affected.