Only the latest 0.x release line receives fixes. Once 1.0 ships, the policy will be revisited.

Email patrick204nqh@gmail.com with subject prefix [textus security]. Include:

• a description of the issue and its impact,
• a minimal reproducer if possible,
• the affected version (textus --version or the gem version),
• any disclosure timeline you have in mind.

You can expect an acknowledgement within 72 hours and a fix or rejection within two weeks for most reports.

Please do not file public issues for security-sensitive matters until a fix is released.