We actively support the current version and maintain the previous version with hotfixes for vulnerabilities that may be reported by our users.

If you discover a security vulnerability in this project, please report it responsibly:

1. Create a new discussion
2. Label it with either security or vulnerability tags
3. Include all necessary information following the discussion template

• Never commit secrets, tokens, or credentials
• Use secure coding practices
• Keep dependencies up to date
• Follow the principle of least privilege
• Validate all inputs

• Always use the latest supported version
• Keep your environment updated
• Report suspicious behavior

This project includes:

• Automated vulnerability scanning (pip-audit)
• Static code analysis
• Code quality checks
• Hermetic builds and releases with integrity verification
• Secure build pipeline

Known vulnerabilities may vary according to the selected Python version.

You can check our latest constraints against vulnerable package versions in our requirements.in file.

The following table lists all known vulnerabilities that could not be fixed:

The official status of Python versions shows which Python versions are no longer supported and therefore are vulnerable.

While we might support some vulnerable Python versions for backwards compatibility, we strongly advise our users to consider upgrading to a more recent version.