Report privately through GitHub's Report a vulnerability button on the Security tab, or by email to the address in MAINTAINERS. Please do not open a public issue.

Include what you did, what you expected, and what happened. A proof of concept helps but is not required to file.

If we miss a window, that is itself worth reporting.

The current major version, plus security backports to the previous one.

In scope, and treated as critical by default:

• Any cross-tenant read or write. One tenant observing, reaching or affecting another is the failure this system is built to make structurally impossible. That includes anything that reveals whether an identifier exists in a tenant the caller cannot name.
• Privilege escalation within a tenant, including granting a permission the caller does not hold, or assigning roles without role:assign.
• A tenant-scoped token reaching the platform plane.
• Token forgery, replay, or acceptance of a token with a missing or unverified claim.
• Any path that writes plaintext credential or token material to disk, logs, metrics or traces.
• Anything that makes an authorization check fail open.

Out of scope: findings that require an already-compromised platform credential; rate limits tuned by the operator; and denial of service through resource exhaustion on a deployment that has not configured the documented rate and concurrency limits — though a way to bypass those limits is in scope.

We will not ask you to delay disclosure beyond the window above, and we will credit you in the advisory unless you ask us not to.