Security fixes are applied to the latest tagged release and to main.

Please use GitHub's private vulnerability-reporting form under the repository's Security tab. Do not disclose a suspected vulnerability in a public issue before the maintainers have had an opportunity to investigate it.

Reports should identify the affected version, describe the expected and observed behavior, and include a minimal reproduction when possible. The maintainers will acknowledge a report, assess its effect on released code and results, and coordinate a fix or public advisory where appropriate.

Numerical disagreements, model extensions, and data-quality questions that do not expose users or systems to a security risk may be reported through the ordinary issue tracker.