The latest versions of both v2.9.x and v3.0.x are supported.

Please do not report security issues publicly (no GitHub issues, pull requests or mailing lists).

Report them privately by opening a draft security advisory on GitHub. The maintainers triage the report there, coordinate a fix with you and publish the advisory together with the fixed release. Reporters are credited in the published advisory.

If you cannot use GitHub, email modsecurity@owasp.org instead.