Cordis is still pre-1.0. Security fixes target the currently published v3 lines:

• cordis-rs 0.8.x;
• cordis-core, cordis-loader, and cordis-timer 0.3.x.

The legacy 0.6.x implementation lives on the legacy/0.6 branch and receives only critical bug and security fixes. Older lines are not actively supported.

Please do not put sensitive technical details in a public issue.

GitHub private vulnerability reporting is not currently enabled for this repository. Until a private reporting channel is configured, open a minimal public issue asking the maintainer for a private contact path, and omit the sensitive technical details from that issue.

When a private channel is available, include the affected version, affected component, impact, reproduction conditions, and any proposed mitigation.

Please allow time for validation and a coordinated fix before public disclosure.