dgr-core is experimental. There are currently no published production-supported releases or security-support guarantees.

Use the repository's Security tab and select Report a vulnerability to create a private vulnerability report for the maintainers.

Do not disclose a suspected vulnerability in a public issue, pull request, discussion, commit, log, or test case. This includes suspected bypasses; authorization, token, or replay weaknesses; fail-closed failures; secret exposure; and supply-chain concerns.

Include, where safely possible:

• the affected public version or commit;
• the impact and required conditions;
• minimal reproduction steps or a proof of concept;
• suggested remediation or mitigations; and
• your preferred disclosure and attribution terms.

Remove live credentials, customer data, private repository information, and unrelated sensitive material. If reproducing the problem requires such material, describe what exists without transmitting it until maintainers establish an appropriate handling method.

The project does not currently promise a response or remediation service level. Maintainers will assess private reports and coordinate any appropriate disclosure before security details are made public.