Only the default branch (main) receives security fixes. Generated projects should update by re-scaffolding or manually bumping the affected dependency.

• Do not open a public issue for security vulnerabilities.
• Email the maintainer via GitHub Security Advisories: New draft advisory or contact @ulises-jeremias directly.
• Include: affected template/extension, package name and version, reproduction steps, and impact.

We will acknowledge receipt within 72 hours and provide a triage timeline.

We triage using docs/MAINTENANCE_SECURITY.md §2:

For cna-templates (no committed lockfiles), fixes land as package.json range bumps or overrides in the affected templates/*/template/package.json or extensions/*/package.json. See docs/MAINTENANCE_SECURITY.md §4 for patterns and npm audit / osv-scanner validation steps.