Report vulnerabilities privately via GitHub Security Advisories — the "Report a vulnerability" button on this repository's Security tab. Please do not open a public issue for a security problem.

Include a minimal reproducer, the commit you tested, and your Python version.

aura-life is pre-1.0 and has no release channel yet — it installs from a git checkout, and there are no supported-version guarantees: fixes land on main. Reports are handled on a best-effort basis by a single maintainer; there is no response-time SLA. Known, deliberately unfixed limitations are documented in DEFERRED.md — worth a read before reporting.