The 1.0 line and the 0.8 transition line receive security fixes. See the stability policy. Reports are handled on a best-effort basis; there is no guaranteed response time.

Report privately through GitHub: open the repository's Security tab and choose Report a vulnerability (direct link). Do not open a public issue containing an exploit, credential, private key, production data, tenant data, or unreleased vulnerability detail.

A report should identify the affected commit or package version, the violated protocol property, a minimal value-free reproduction, and the expected fail-closed result.

This package validates structural protocol facts. It does not discover trust, hold keys, issue or revoke grants, evaluate live authorization, reserve replay, execute tools, own effects, or decide product policy. Consuming hosts must treat every successful result as non-authorizing evidence.