diff --git a/SECURITY.md b/SECURITY.md
index fa2f5b1..f473221 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -2,11 +2,23 @@
 
 ## Supported Versions
 
-| Version | Supported          |
-|:-------:|:------------------:|
-|       3 | :white_check_mark: |
-|       2 | :white_check_mark: |
-|       1 | :x:                |
+Only report a vulnerability for the latest version (according to their branch) of supported crates:
+
+| Name                           | Directory            | Branch | Supported |
+|--------------------------------|----------------------|--------|-----------|
+| `data-encoding`                | `lib`                | `main` | Yes       |
+| `data-encoding-bin`            | `bin`                | `main` | Yes       |
+| `data-encoding-macro`          | `lib/macro`          | `main` | Yes       |
+| `data-encoding-macro-internal` | `lib/macro/internal` | `main` | No        |
+| `data-encoding-v3`             | `lib/v3`             | `main` | No        |
+
+Notes for unsupported crates:
+
+- `data-encoding-macro-internal` is an implementation detail of `data-encoding-macro`. A bug only
+  reachable by using it directly is not a vulnerability, whereas a bug reachable through
+  `data-encoding-macro` is.
+- `data-encoding-v3` is a development crate for `data-encoding`. A bug only reachable in
+  `data-encoding-v3` is not a vulnerability, whereas the same bug reachable in `data-encoding` is.
 
 ## Reporting a Vulnerability
 
@@ -14,4 +26,6 @@ Click **Report a vulnerability** from the [Security Advisories][advisories] page
 acknowledgment within 24 hours and triage assessment within 7 days. If the vulnerability is
 accepted, we will work with you for a patch release.
 
+Do not report security vulnerabilities through public GitHub issues or pull requests.
+
 [advisories]: https://github.com/ia0/data-encoding/security/advisories
diff --git a/xtask/Cargo.toml b/xtask/Cargo.toml
index 85fdf90..d0cebc8 100644
--- a/xtask/Cargo.toml
+++ b/xtask/Cargo.toml
@@ -2,6 +2,7 @@
 name = "xtask"
 version = "0.1.0"
 edition = "2021"
+publish = false
 
 [dependencies]
 serde = { version = "1.0.136", features = ["derive"] }