Only the latest release of @musterhq/cli (and the matching @musterhq/* packages) receives security fixes.

Report privately using GitHub Security Advisories: Security tab > Report a vulnerability (https://github.com/musterhq/muster/security/advisories/new). Do not open a public issue or pull request.

Include the affected version, what you found and steps to reproduce. We aim to acknowledge reports within a few days and will keep you updated until a fix ships. Please allow reasonable time for a fix before disclosure. Relevant areas: the gateway and channel adapters, capability-pack sandboxing and egress policy, credential and ledger handling, MCP bridges.