The latest release on PyPI is supported. Pre-1.0, fixes land in the newest 0.x minor only — upgrade to the latest version before reporting.

This library is a correctness layer around irreversible side effects, so treat any way to make a guarded handler run twice, skip a legitimate run, or act on another claimant's record (a fencing bypass) as a security-relevant bug — not just a functional one.

Report privately via GitHub → Security → Report a vulnerability on this repository (GitHub private vulnerability reporting). Do not open a public issue for an unfixed vulnerability. Include the backend involved (Datastore / Redis / SQL / in-memory), the delivery shape (push, Eventarc, streaming pull), and a reproduction — the tests/test_backend_contract.py harness is usually the fastest way to express one.

You will get an acknowledgment within 7 days. Fixes are released as a patch version and noted in the CHANGELOG; credit is given unless you ask otherwise.

• The library never reads message payloads and stores no payload data in its records — a record holds the opaque key, state, fencing token, and timestamps only.
• The threat model does not include an attacker with write access to the backing store (Datastore/Redis/SQL): whoever can write the records can trivially defeat any lock built on them. Protect the store with IAM/network controls.