Security fixes are provided for the latest minor release while the project is pre-1.0.
| Version | Supported |
|---|---|
| 0.1.x | Yes |
| Earlier | No |
Please do not open a public issue for a suspected vulnerability.
Use GitHub private vulnerability reporting and include:
- affected version and API;
- a minimal reproduction or attack narrative;
- expected and observed behavior;
- impact and any known workaround;
- whether the report is under coordinated disclosure.
We aim to acknowledge complete reports within three business days, provide an initial assessment within seven business days, and coordinate a fix and disclosure timeline with the reporter. These are response goals, not a service-level agreement.
Review docs/threat-model.md before reporting an integration problem. Bugs in this policy kernel are in scope. Missing authentication, non-atomic enforcement, unsafe storage mapping, or other violations of the documented adapter contract may need to be fixed in the host application instead.