Do not open public issues for vulnerabilities. Use GitHub's private vulnerability reporting for taucad/geospec.

Supported releases are the latest stable version of geospec-engine on npm and PyPI. Reports should include the affected version, host (Node, Python or browser), reproduction, and expected impact. Maintainers acknowledge a report, coordinate a fix, and publish through the normal CI release pipeline with npm provenance.