Please do not open a public issue for a security vulnerability.

Report it privately, either way works:

• Open a private security advisory on this repository.
• Email security@mulgadc.com.

Please include enough for us to reproduce it: the version or commit, the configuration involved, and the steps that trigger it. If you have a proof of concept, include that too.

We aim to acknowledge a report within three business days. We will confirm whether we can reproduce it, agree a fix and a disclosure timeline with you, and credit you in the advisory unless you would rather we did not.

Northstar is one part of the Mulga stack. If a vulnerability spans more than one component, report it once against whichever repository you found it in and we will handle the rest.

Fixes land on the latest release and on main. Older releases are not patched.