Until the first public release, the current main branch is the supported
version for security fixes.
Please do not report security vulnerabilities as public GitHub issues.
Report suspected vulnerabilities confidentially first:
This address is a placeholder and must be replaced with the final project security contact before the public GitHub release.
Security reports may include, but are not limited to:
- Authentication and session handling
- Event API intake and signature verification
- Connector interfaces and connector isolation
- Docker and local development configuration
- Dependency vulnerabilities
- Handling of secrets, credentials, or private configuration
Enterprise or private connector implementations that live outside the Community Core should be reported through their own security channels.