Supported: latest minor release only.

Report: private advisory. Do not open public issues for vulnerabilities.

Disclosure: fix or mitigation within 90 days of a confirmed report; public disclosure after that window.