We actively support the latest minor of 1.x (e.g., 1.18.*). Older minors receive fixes at our discretion.
Email security@richertunes.com with details and a proof of concept if possible. We’ll acknowledge within 3 business days, provide a remediation plan or timeline within 10 business days, and credit reporters if desired.
Please do not open public issues for potential vulnerabilities. We’ll work with you on a coordinated disclosure and publish a fix + release notes.