Kova is currently pre-1.0. Security fixes are applied to the latest release and main; older revisions are not supported unless a release note says otherwise.

Use GitHub private vulnerability reporting to report suspected vulnerabilities. Do not open a public issue or include sensitive details in a pull request.

Include the affected component and version, reproduction steps or a proof of concept, impact, and any suggested mitigation. You can expect an initial acknowledgement within seven days. We will coordinate validation, remediation, and disclosure through the private advisory.