Security patches land on main and in the latest release. Older releases get backports only under long-term support.

• Report privately through GitHub Security Advisories, or by mail to info@wavelens.io.
• Never open a public issue or pull request for a vulnerability.
• Include the affected version, the component (server, worker, frontend, CLI, NixOS module) and steps to reproduce.
• A diagnostic report can go into the advisory. Keep identities anonymized unless they matter for the issue.

Maintainers confirm the report, agree on a disclosure date with the reporter and publish an advisory together with the fix.