Use the current coordinated SDK/Viewer release. Earlier releases may lack authentication or release guards. Only the current release line receives fixes; there is no LTS commitment.

Report vulnerabilities through GitHub private vulnerability reporting when enabled. If unavailable, open an issue requesting a private contact without exploit details, tokens or user captures. Include affected versions, platform, synthetic reproduction and impact privately.

The maintainer will investigate and coordinate disclosure; no response SLA or independent audit is claimed. See security boundaries and release guidance.