Security fixes are provided for the latest published Forms Toolkit version. Prerelease versions are supported on a best-effort basis until the first stable release.

Do not open a public issue for a suspected vulnerability. Use GitHub private vulnerability reporting to contact the maintainers privately.

Include the Forms Toolkit version, Xperience version, affected feature, impact, and reproduction steps. Do not include real form submissions, uploaded files, credentials, connection strings, or other personal or customer data. Use sanitized examples only.

The maintainers will acknowledge the report, investigate it, and coordinate a fix and disclosure timeline with the reporter. Please allow a reasonable remediation period before public disclosure.

Forms Toolkit is maintained by Andres Villenas and SimpleA and is not an official Kentico product. Reports concerning Xperience by Kentico itself should be submitted through Kentico's official security channels.