The newest tagged 0.1.x release and announced release candidates receive security fixes. Older snapshots are unsupported.

Report vulnerabilities privately to me@richardhoekstra.com. The maintainer is RichardHoekstra. If GitHub private vulnerability reporting is enabled, you may also use that repository feature.

Include the version, export identity, reproduction, impact, and smallest safe fixture. Do not include credentials or third-party personal data. Coordinate disclosure before opening a public issue.

Receipt forgery, unsafe deserialization, capability escalation, resource-bound bypass, and verifier/client authority confusion are security issues.