| Version | Supported |
|---|---|
| 3.x | Yes |
| 2.x | Security fixes only |
| < 2.0 | No (the frozen v1 file dist/location-picker.min.js is maintained in 3.x) |
Please do not report security vulnerabilities through public GitHub issues.
Instead, report them privately by emailing rayansalhab@hotmail.com with:
- a description of the issue and its potential impact;
- steps to reproduce (a minimal proof of concept is ideal);
- the affected version and how the library is loaded (script tag URL or npm entry).
- You should receive an initial acknowledgement within 72 hours.
- We aim to provide a status update (triage outcome, fix timeline, or request for more information) within 7 days.
- Once a fix is ready, we will coordinate a disclosure date with you before publishing.
Thank you for helping keep location-picker and its users safe.