Until 1.0, only the latest published version of each @codecora/* package
receives fixes.
Do not open a public issue for a vulnerability.
Use GitHub Private Vulnerability Reporting,
or email hello@codecora.dev with the subject [CodeCora UI security].
Include a description, steps to reproduce, the affected package and version,
and the impact you see.
- Acknowledgment within 3 working days.
- An assessment and a fix plan, or a reasoned decline, within 14 days.
- Credit in the release notes if you want it.