Do not open a public issue for a suspected vulnerability. Report it privately through the repository's GitHub Security Advisory flow. Include the affected module and version or commit, a clear description, reproduction steps or a minimal proof of concept, impact, and known mitigations.

While jcompose is pre-release, security fixes target the latest default branch. After the first JDK release, this policy will be updated to identify supported release lines.