Only the latest release of quarto-marimo receives security fixes.

Please do not open a public GitHub issue for security vulnerabilities.

Report vulnerabilities via GitHub's private security advisory feature.

We aim to:

• Acknowledge receipt within 3 business days
• Triage and assess severity within 7 business days
• Release a patch within 90 days (sooner for critical issues)

We appreciate responsible disclosure and will credit reporters in the release notes unless you prefer to remain anonymous.