Security fixes target the latest published release; older versions may require
an upgrade.
Report suspected vulnerabilities privately using **Report a vulnerability** on
[GitHub Security](https://github.com/hupe1980/sepa/security).
If that action is unavailable, do not post vulnerability details publicly.
Include the affected version, a minimal reproducer and the potential impact.
Use synthetic payment data; never include bank credentials or customer records.