Only the latest minor release receives security fixes.

If you find a security issue, please do not report it as a public issue. Instead, report it through one of the following channels.

1. (Recommended) GitHub Security Advisory: https://github.com/ryuichi1208/rw/security/advisories/new

2. By email: r_watanabe@ivry.jp

Please include the following information in your report:

• A summary of the vulnerability and its impact
• Reproduction steps / PoC
• Affected versions
• Any known mitigations (if applicable)

• Acknowledgment: we will reply to confirm receipt within 7 days
• Assessment: we will share a severity assessment and remediation plan within 14 days
• Fix: depending on severity, we plan to release a patch within 30–90 days
• Disclosure: after the fix is released, we will publish it as a GitHub Security Advisory