Please report vulnerabilities privately through GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository.

Do not open a public issue, pull request or discussion for a suspected vulnerability.

Please include:

• a description of the issue and its impact,
• steps to reproduce or a proof of concept,
• affected versions or components, if known.

• We acknowledge reports and keep you informed while we investigate.
• We follow coordinated vulnerability disclosure with a default embargo of 90 days, shortened when a vulnerability is actively exploited.
• Fixes are always released in the open-source version; security fixes are never limited to a paid offering.
• Advisories are published as GitHub Security Advisories, and reporters are credited unless they ask otherwise.

The project is at the specification stage; no released software exists yet. Reports about the specification's security design are welcome through the same private channel.