The project is pre-release and offers no security-response service-level agreement. Do not publish exploit details in a public issue: report a vulnerability through GitHub's private security-advisory channel when it is available, or otherwise contact the maintainers privately through the repository owner profile.

Production files and media paths are treated as untrusted input. Security fixes take priority over compatibility during the 0.x series and will be documented in the changelog.