| Version | Supported |
|---|---|
| 1.x | Yes |
| Earlier versions | No |
Source-copy consumers own and may modify installed Protoform files. Security fixes are published as
new immutable tags; consumers must rerun shadcn add, inspect the diff, and merge the fix.
Do not open a public issue. Use GitHub private vulnerability reporting with affected versions, impact, reproduction conditions, and any suggested mitigation.
The maintainer will acknowledge reports on a best-effort basis, coordinate a fix and advisory when confirmed, and credit reporters who request attribution. No response or remediation service-level agreement is offered.