Security

SECURITY.md

Security Policy

Supported Versions

Security fixes are applied to the active main branch and current milestone release line.

Reporting a Vulnerability

Please report vulnerabilities privately by opening a GitHub security advisory for this repository.

If security advisories are unavailable in your context, open a private report to the maintainers and include:

affected file(s)/component(s)
impact and exploitability
minimal reproduction
proposed remediation (if available)

Do not post sensitive exploit details in public issues before a fix is available.

Triage Expectations

Initial acknowledgement target: within 3 business days
Severity assessment: critical/high/medium/low
Fixes are prioritized by exploitability and user impact

Disclosure

After remediation, publish a public summary including:

affected versions/commits
mitigation/fix
any required user action

Security Architecture References

Threat model (v0.7): docs/security/THREAT_MODEL_v0.7.md
v0.7 design security section: docs/milestones/v0.7/DESIGN_v0.7.md

There aren't any published security advisories