If you believe you have found a security vulnerability in z4j-celerybeat, do not open a public GitHub issue. Email security@z4j.com instead.

We acknowledge reports within 48 hours, provide a preliminary assessment within 5 business days, and target fixes within 30 days (7 days for confirmed critical issues). Reporting timelines, safe harbor, supported-version policy, and published advisories are maintained in the canonical z4j project security policy.

This adapter inventories static Celery Beat configuration and, with a Celery app attached, triggers any listed entry on demand. When django-celery-beat is present it also executes authenticated create, update, toggle, and delete controls with the application's Django database access. Schedule argument mapping, backend selection, ORM mutation, and indeterminate timeouts are package-specific security surfaces; transport, redaction, and authorization policy remain owned by z4j-core and the brain.