We take the security of Modelplane seriously and appreciate responsible disclosure of vulnerabilities.

Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Instead, report them privately through GitHub's private vulnerability reporting: open the Security tab of this repository and choose Report a vulnerability. This opens a private advisory visible only to the maintainers.

Please include as much of the following as you can:

• The type of issue and the component or resource affected.
• The version or commit you observed it on.
• Steps to reproduce, including any manifests, configuration, or proof-of-concept.
• The impact: what an attacker could do with it.

• We aim to acknowledge a report within a few business days.
• We will work with you to understand and validate the issue, and keep you updated on remediation progress.
• Once a fix is available we will coordinate disclosure and credit you, unless you prefer to remain anonymous.

Modelplane is an early, pre-1.0 project under active development. Security fixes are applied to the latest release on the default branch. There is no long-term support branch yet; this policy will expand as the project matures and adopts a formal governance structure (see GOVERNANCE.md).