Until 1.0, only the newest minor line receives security updates.

Do not open public issues for vulnerabilities. Use GitHub private vulnerability reporting on arts-link/screenshot-a-day. Include the affected version, reproducible impact, and any safe mitigation.

Target headers, cookies, worker credentials, installation keys, private screenshots, and full URLs containing sensitive paths must not appear in reports unless transmitted through the private channel.