Before the first stable release, only the current main branch receives security fixes. A version support table will be published with the first release.

Please use GitHub's private vulnerability reporting for this repository. Do not open a public issue for suspected tenant isolation, authorization, secret exposure, injection, erasure, dependency, or supply-chain vulnerabilities. Include affected revision, impact, minimal reproduction, and any suggested mitigation. Do not include real customer data or active credentials.

The maintainers will acknowledge a complete report within three business days and coordinate validation, remediation, release, and credit. Any unauthorized result is treated as a critical incident. Good-faith research against your own local synthetic deployment is welcome; do not test systems or data you do not own or have permission to assess.