Please report suspected vulnerabilities through GitHub's private vulnerability reporting. Do not open a public issue for a vulnerability or include credentials, personal information, or production data in a report.

Include the affected version or commit, the conditions needed to reproduce the issue, its likely impact, and a minimal reproduction where practical. We will acknowledge a valid report, coordinate a fix, and publish an advisory when disclosure is safe.

This policy covers Restless Core. Security questions about the hosted Restless service should use the verified support channel supplied with that service.