The latest released minor version receives security fixes. Because this package sits on the request/response boundary, we take reports seriously and aim to respond quickly.

Please do not open a public issue for security vulnerabilities.

Instead, report privately via one of:

• GitHub's private vulnerability reporting (preferred), or
• email shamavurasheed@gmail.com with the details.

Please include:

• a description of the vulnerability and its impact,
• steps to reproduce (a minimal proof of concept if possible),
• the affected version(s) and PHP version.

• We will acknowledge your report within 72 hours.
• We will provide an assessment and a remediation timeline as soon as possible.
• We will credit you in the release notes once a fix is published, unless you prefer to remain anonymous.

Thank you for helping keep the community safe.