Security fixes are applied to the latest commit on the main branch. This repository does not currently publish versioned releases, so older commits and forks are not maintained as separate security-support channels.

Please use GitHub private vulnerability reporting. Do not disclose a suspected vulnerability in a public issue, pull request, discussion, or social-media post before we have coordinated disclosure.

Include as much of the following as you can:

• the affected file, script, or workflow;
• a description of the impact and who could be affected;
• clear reproduction steps or a minimal proof of concept;
• any conditions required to exploit the issue;
• a suggested mitigation, if you have one.

Avoid including secrets, credentials, or personal data in the report.

We will acknowledge the report as soon as practical, validate the finding, determine its scope, and coordinate remediation and disclosure with the reporter. Please allow time for a fix to be developed and tested before public disclosure.

Please avoid accessing, modifying, or deleting data that does not belong to you, disrupting services, or degrading other users' experience. If testing could affect other people or systems, stop and submit a private report first.

Thank you for helping keep Diagram Design and its users safe.