Security fixes are released for the latest minor version of each supported release series.

Report a vulnerability privately through the Report a vulnerability button of the repository's Security tab, which opens a private advisory that only the maintainers see. Do not open a public issue or pull request for it.

A report states the affected version, the steps or the input that reproduce the issue, and its impact. The maintainers acknowledge a report within seven days, agree on a disclosure date with the reporter, and publish the fix, the patch releases and the advisory together, crediting the reporter unless they ask otherwise.

Published advisories are listed at https://github.com/MobilityDB/MobilityDB/security/advisories.