Send suspected vulnerabilities privately to Johan Lindvall at johan.lindvall@gmail.com, with objpool security in the subject. Please avoid disclosing exploit details in public issues or pull requests before a fix can be coordinated.

Include the affected objpool version, Go version, a minimal reproduction, and the impact you believe the issue has. Remove credentials and private data from your report.

Security fixes target the latest tagged version. Older releases are not maintained as separate branches; users should update to the release containing the fix. Reports are reviewed by the maintainer as availability allows.

The pool protects its own storage, not concurrent access to a checked-out object. Returning the same checkout twice or accessing it after Put can expose one caller's data to another. Put does not erase contents, and a buffer reset does not erase its backing storage.

See the ownership guide for correct usage. General questions and non-security bugs belong in the issue tracker.