Please report security issues privately via GitHub Security Advisories — open a new report at Report a vulnerability rather than a public issue. We aim to respond within 72 hours.

Security fixes land on the latest released version. Upgrade to the newest release before reporting, in case the issue is already fixed.

The full trust contract, outbound-network posture, and supply-chain threat model live in docs/security.md.