Security updates are provided for the latest published release on the main branch.

If you believe a vulnerability affects an older release, please still report it. Fixes may be shipped only in the latest version.

Please do not open a public GitHub issue for suspected security vulnerabilities.

Instead, report the issue privately to justin.beckwith@gmail.com with:

• A description of the issue and its potential impact
• Steps to reproduce or a proof of concept
• The affected package version and runtime environment
• Any relevant logs, request samples, or device details needed to reproduce

You should avoid including secrets in your report, such as device auth tokens, Wi-Fi credentials, or private network information unless they are strictly necessary to explain the issue.

You can expect an initial response within 5 business days. After triage, the maintainer will work with you on validation, remediation, and disclosure timing.

Please allow time for a fix to be prepared before public disclosure. Once a fix is available, the remediation can be released through the normal GitHub and npm release process.