Please report vulnerabilities privately through GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository.

Do not open a public issue, pull request or discussion for a suspected vulnerability.

Please include:

• a description of the issue and its impact,
• steps to reproduce or a proof of concept,
• affected versions or components, if known.

• We acknowledge reports and keep you informed while we investigate.
• We follow coordinated vulnerability disclosure with a default embargo of 90 days, shortened when a vulnerability is actively exploited.
• Fixes are always released in the open-source version; security fixes are never limited to a paid offering.
• Advisories are published as GitHub Security Advisories, and reporters are credited unless they ask otherwise.

The project is pre-alpha; no release exists yet. Reports about the code on main and about the security design are welcome through the same private channel. A running server also publishes its contact details at /.well-known/security.txt (RFC 9116).