Security fixes are made on the latest release and the main branch. Older releases do not receive backports; the download page always offers the newest installer.

Please do not open a public issue for a vulnerability that could expose user files, execute untrusted code from an opened or dropped file (SVG, EPS, AI, .vform or an image), or bypass path validation.

Use GitHub's private vulnerability reporting flow:

https://github.com/binodray/VectorForm/security/advisories/new

Include:

• the affected version or commit;
• clear reproduction steps;
• the expected security boundary and observed behavior;
• impact and any known workaround;
• a proof of concept only when it can be shared safely.

You should receive an acknowledgement within seven days. Please allow time for investigation and a coordinated fix before publishing details.