We generally support the latest minor release of the project. Security fixes will be backported at our discretion.

Please do not create a public issue for security vulnerabilities. Instead, click on the "Report a vulnerability" button on the top right of https://github.com/leighton-digital/lambda-toolkit/security. We'll acknowledge receipt within 2 business days and provide a timeline for a fix once triaged.

After a fix is released, we'll credit reporters (if desired) in the release notes.