Security fixes target the latest release. Upgrade before reporting an issue that may already be fixed.

Use GitHub private vulnerability reporting. Do not open a public issue for an unpatched vulnerability.

Include version, impact, reproduction, and possible mitigation. Maintainers coordinate validation, fixes, and disclosure on a best-effort basis. Keep details private until release or an agreed disclosure date.

Scope includes sanitization, SSR, remote loading, service workers, dev server, CLI paths, and supply-chain risks. Surprising or undocumented risks from disabled protections are also useful reports.