TwinStor follows the Vates security process, described in Security at Vates: how reports are handled, coordinated disclosure, and security advisories.

Please do not open a public issue. Report it privately to security@vates.tech, with the TwinStor version, the XCP-ng version, and steps to reproduce if you have them.

A bug that can lose acknowledged writes, serve stale data, or let both hosts write diverging copies is handled like a security issue even when no attacker is involved. If you can reproduce one, report it privately as above and attach twinstor support-bundle output from both hosts.

TwinStor is a tech preview. Fixes go into the latest release only.