This repository contains the TESSERA specification, not an implementation.

• A gap or ambiguity in the specification (for example a scoring or data-model rule that could mislead operators): open a normal issue.
• A vulnerability in an implementation (the server tessera or the tessera-grafana-panel plugin): report it to that repository's maintainers, following its own SECURITY.md once it is public.
• Anything you would rather not discuss publicly before it is triaged: report privately, see below.

Write to info@favus.org. An encrypted report is possible with the GPG key 3312E2E9. Please do not open a public issue for these reports before they have been triaged.

Best effort, no SLA yet. This is a small, early-stage project; the policy will be revised when the implementations have real users.