We currently support the latest minor release of the 1.x series. Older releases should be upgraded to receive security patches.

If you discover a security vulnerability, please contact us at [email protected]. Please do not open a public issue.

Include as much detail as possible, including:

• Steps to reproduce the vulnerability
• Potential impact
• Suggested mitigation (if available)

We will acknowledge receipt within 48 hours. After evaluation, we will work with you on a disclosure plan and release timeline.

We prefer security reports in English or Indonesian.

We follow responsible disclosure practices. Once a fix is ready, we will:

1. Release a patched version via Composer.
2. Publish release notes detailing the vulnerability and remediation steps.
3. Credit reporters who wish to be acknowledged.