The latest minor of the current major receives fixes. Older lines do not.

Report privately through GitHub's security advisories rather than in an issue.

ngtrue runs inside builds and test suites, so the interesting reports are the ones where a check reads something it should not, or where a crafted manifest or source file makes it execute code. Include the manifest or fixture that triggers it and the version you ran.

Expect a first reply within a week.