Security fixes land on main and ship in the next release. Only the latest release is supported, so update with lerd update before reporting.

Please do not open a public issue. Report it privately through GitHub's vulnerability reporting instead, with the lerd version, your OS, and the steps to reproduce.

You will get a reply within a few days. Once a fix is merged, the advisory is published and the reporter credited unless they prefer otherwise.

Vulnerabilities in a framework definition or service preset belong to lerd-env/frameworks or lerd-env/services, and in a plugin to that plugin's own repository.