Security

SECURITY.md

Security Policy

Reporting

Do not open public issues for exploitable vulnerabilities.

Report security findings privately to project maintainers with:

affected version or commit
reproduction steps
impact summary
suggested mitigation if known

Scope

Priority areas:

controller mutation paths
runtime API exposure
UI or browser-surface injection
Docker and runtime bootstrap trust boundaries

There aren't any published security advisories