Security fixes go into the latest release. If you are running an older version, update to the current release first. Older releases do not receive separate patches.

Please do not open a public issue for anything security-sensitive.

Instead, use GitHub's private vulnerability reporting: open the Security tab of this repository and click Report a vulnerability. Your report stays visible only to the maintainers until a fix is released.

Include what you found, how to reproduce it, and how your OpenAVC system is deployed (operating system, install method, version). We will respond as quickly as we can, and we are happy to credit you for the find if you want.