Security fixes are applied to the latest release on the default branch when feasible.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report privately using one of these options:

1. GitHub Security Advisories (preferred):
   Report a vulnerability
2. Contact the maintainer on GitHub: @ahuryx

Include as much detail as you can:

• Description of the issue
• Steps to reproduce or a proof of concept
• Affected versions / commit if known
• Potential impact

You should receive an acknowledgment within a few days. We will assess the report, work on a fix when confirmed, and coordinate disclosure. Please give us reasonable time to release a patch before any public discussion.

Thank you for helping keep Arc and its users safe.