Report vulnerabilities to hi@emitkit.com, not in a public issue. Include what you found, how to reproduce it, and whether it affects emitkit.com, self-hosted deployments, or both. You'll get a reply within a few working days.

Fixes land on main, which deploys emitkit.com. Self-hosted deployments get them by pulling and deploying again (see Deployment).