Sundew is a single-maintainer project; the latest commit on main is the only supported version.

To report a vulnerability, use GitHub's private vulnerability reporting on this repository (Security tab, "Report a vulnerability"). Please don't open a public issue for anything exploitable. You should hear back within a week.

Out of scope: rate-limit tuning, denial of service against your own self-hosted instance, and automated-scanner reports without a demonstrated impact.