Security Policy

Progress Platform is maintained by a small team. We treat security reports seriously but cannot commit to formal SLAs at this stage.

Reporting a vulnerability

Please use GitHub Private Vulnerability Reporting. This delivers the report directly to the maintainers without making it public.

We will respond on a best-effort basis. There is no committed acknowledgment window at this time.

Only the current DEV branch (latest tag) is supported. We do not backport security fixes to earlier releases.