Security updates are provided for the latest published release and the current main branch. Older releases should be upgraded before a report is validated or a fix is backported.

Please report suspected vulnerabilities privately through GitHub Security Advisories. Do not open a public issue for an undisclosed vulnerability.

Include the affected version or commit, reproduction steps, expected impact, and any suggested mitigation. We aim to acknowledge reports within seven days and will coordinate disclosure after the issue is understood and a remediation is available.

This policy covers the OpenUltraCode plugin, its installers, and its release automation.