Report vulnerabilities privately through GitHub's vulnerability reporting, not as public issues.

Only the latest release gets fixes.

Every release ships with build provenance and a SHA256SUMS file. Verify a download with:

gh attestation verify <file> -R bhark/eckermann