Do not open a public issue for a vulnerability.

Email llc@isomux.com with the subject Security report. Include the affected version, the impact, steps to reproduce, and any suggested fix. Do not include credentials or private customer data unless we ask for them through a secure channel.

Nil Mamano owns the response. He will acknowledge the report, assess it, and coordinate a fix and release. We do not publish a response-time promise yet.

If you make a good-faith effort to follow this policy, avoid privacy violations and service disruption, and report a vulnerability promptly, we will consider your research authorized. We will not pursue legal action against you for an accidental, good-faith violation of this policy. If a third party starts legal action related to research that follows this policy, we will state that your work was authorized.

Stop after you have enough evidence to show the issue. Do not access, change, retain, or share another person's data. Do not use denial of service, social engineering, credential attacks, malware, or destructive tests. Ask us before you test a production system beyond passive public checks.

Isomux uses a rolling release channel. Security fixes ship in a new CalVer release whose GitHub Release carries a machine-readable security marker. The owner still chooses when to apply each release.