Security fixes target the current main branch and, once published, the current public Threat10 release. Planned adapters and routes are not supported features until implemented and verified.

Use GitHub's private Report a vulnerability form in this repository's Security tab when available. If it is unavailable, open a public issue asking the maintainers to establish a private reporting channel, but do not include exploit details, secrets, personal information, or sensitive data.

Include the affected route or component, reproduction conditions, likely impact, and a safe proof of concept. Browser application, build workflow, dependency supply chain, immutable-file integrity, source-policy enforcement, and unsafe rendering issues are in scope. Upstream content corrections should identify the authoritative publisher and record.

There is no bug-bounty programme or guaranteed response time. Allow maintainers a reasonable opportunity to investigate before public disclosure.