Security fixes go into the latest minor release.

Please do not open a public issue. Report privately through GitHub's private vulnerability reporting. Include affected versions, impact, and steps to reproduce.

We aim to acknowledge reports within 3 business days and to agree on a disclosure timeline with you.

Deployment guidance (permissions, credentials, what leaves the cluster) is in docs/security.md.