Security fixes are backported to the latest minor release of the current major version and the latest minor release of the immediately preceding major version. Older major/minor streams do not receive security patches.

If you think you have found a security vulnerability in springdoc-openapi, please DO NOT disclose it publicly, and don't report it in a GitHub issue, until it has been fixed.

Report it through the Tidelift security contact. Tidelift will coordinate the fix and disclosure.