Please report a vulnerability through a private GitHub security advisory. Include the affected commit, a minimal reproduction, the impact, and any known mitigation. Do not put an unpatched vulnerability or secret in a public issue.

Security reports can cover the build and validation tools, the example viewer, or an SVG construct that behaves unexpectedly in a supported renderer. Reports about Qur'anic text, glyphs, tajweed, layout, or metadata should use the public Qur'an data or rendering form so they receive the appropriate review.

Only the latest published release and the current default branch receive fixes.