Report vulnerabilities through GitHub's private vulnerability form. Do not open a public issue for an unfixed vulnerability.

Include the affected version or commit, a minimal reproduction, impact, and any conditions required to reach the problem. Remove credentials, private market data, and proprietary strategy details.

Incorrect indicator output without a security impact is an ordinary bug report. A report is security-sensitive when it can cause memory unsafety, denial of service from untrusted input, unauthorized data exposure, dependency compromise, or another exploit beyond a wrong calculation.

Security fixes target the current release line. Older releases receive fixes only when the maintainer says so in the advisory.