Sheen has not published its first release. Until then, security fixes apply to the current main branch. After publication, only the latest stable release line will receive security fixes unless a release note states otherwise.

Use GitHub private vulnerability reporting. Do not include exploit details, credentials, private application code, or sensitive deployment information in a public issue.

Include the affected package and version or commit, the impact, minimal reproduction steps, and any suggested mitigation. If private reporting is unavailable, contact a Gemologic repository owner privately before disclosing details.