This is an independent community project, maintained on a best-effort basis. There is no commercial support and no guaranteed response time, but security reports are taken seriously and handled as promptly as circumstances allow.

Please report vulnerabilities privately through GitHub's private vulnerability reporting: open the Security tab and choose Report a vulnerability, or go to https://github.com/benemon/dufflebag/security/advisories/new.

Do not open a public issue for a suspected vulnerability.

Include enough detail to reproduce the problem — affected version or commit, configuration, and the impact you observed. A proof of concept helps but is not required.

Fixes land on main and ship in the next tagged release. Only the latest release is supported; there are no backports to earlier tags.