Only the main branch and the version currently deployed from it receive security fixes. Older commits, forks, and unmerged branches are not supported.

Please report vulnerabilities privately using GitHub Private Vulnerability Reporting: open the Security tab of this repository and choose Report a vulnerability.

Do not open public issues, pull requests, or discussions for security problems.

Please include a description, affected component, reproduction steps or proof of concept, and the potential impact.

• Acknowledgement within 3 business days.
• Triage and severity assessment within 7 business days.
• We will keep you updated on the fix progress and coordinate the release.

• Protobuf contracts and validation rules (buf.validate), generated-code pipeline, and the CI workflows in this repository.
• Issues such as missing or weak request validation, or contract changes that weaken authorization semantics.

Out of scope: social engineering, denial-of-service via volumetric traffic, and findings in third-party services we do not operate.

We follow coordinated disclosure: please give us a reasonable time to ship a fix before any public disclosure. We will credit reporters in the advisory unless they prefer to remain anonymous.