Please report security vulnerabilities privately through GitHub. Include the affected Coco version or commit, a minimal reproduction, the impact, and any suggested fix. Do not include real credentials or unrelated private data. Please avoid publishing exploit details in a public issue before a fix is available.

Security fixes target the latest code on main. Older releases may need to upgrade to receive a fix; no separate long-term support branches are currently maintained.

请通过 GitHub 私密漏洞报告反馈安全问题，包含受影响的版本或提交、 最小复现、影响范围以及可能的修复建议。请勿附带真实凭证或无关的私人数据， 修复完成前请避免在公开 Issue 中披露漏洞利用细节。

安全修复以 main 分支的最新代码为目标；旧版本可能需要升级，目前不单独维护长期支持分支。