Security fixes are considered for the latest release and the current master branch.

Report vulnerabilities through GitHub Private Vulnerability Reporting. Do not open a public issue.

Include the affected version, impact, reproduction steps, and known mitigations. Remove credentials, phone numbers, Call-IDs, raw SIP messages, packet captures, and identifiable network details.

Reports are handled on a best-effort basis. No response or fix time is guaranteed. Keep the report private until disclosure is coordinated with the maintainer.

For non-security bugs, use GitHub Issues. Operational hardening is documented in docs/SECURITY.md.