Security fixes land on the latest released package version only; there are no maintenance branches for older releases. The language spec version (mklang: per-file field) is independent — see CHANGELOG.md for the two version lines and docs/guides/stability.md for the SemVer policy.

Please report vulnerabilities privately via GitHub Security Advisories — do not open a public issue. Expect an acknowledgement within a week.

In scope:

• The reference interpreter (src/mklang/): engine, adapters, CLI, MCP server, console, host tools (fs workspace confinement, write grants).
  • The MCP server is read-only to disk by design: it can author, validate (check) and run inline machines, but exposes no persist/write tool — headless hosts gain no general filesystem-write authority (ADR 0011, ADR 0013; persistence is an explicit per-call checkpoint opt-in only).
• The delimiting guarantees of SPEC §6 (a way to make untrusted content escape its <data-NONCE> fence, forge a closing tag, or launder taint).
• Checkpoint handling (0600 files, resume taint fail-safe).

Out of scope (documented limitations, not vulnerabilities):

• Model persuasion by fenced content — SPEC §11 states delimiting is a mitigation, not a proof; dual-channel control is an open question (§9).
• Checkpoint-at-rest confidentiality beyond file permissions (host-side concern, SPEC §11).
• Provider/API-key compromise and network policy (host-side).

The language's honest threat model lives in SPEC.md §11 — assets, trust boundary, known attack surface, and partial mitigations. Design decisions are recorded in docs/adr/, notably ADR 0025 (untrusted-context delimiting) and ADR 0024 (fs workspace model).