Report suspected vulnerabilities through GitHub's Report a vulnerability form in this repository's Security tab. Private vulnerability reporting is enabled for this repository. Do not open a public issue, discussion or PR with exploit details or secrets.

Include the affected version/commit, platform, impact, minimal reproduction and any suggested mitigation. Share only the data needed to reproduce the issue; remove credentials, account details, private paths and personal images. Never send passwords, tokens or private keys. If the private form is unavailable, withhold sensitive details until a private channel is available; a public issue may ask only for a private reporting channel.

Orient is a development preview. Security fixes target current main and the latest published development preview; older previews have no promised backports. Report issues in either supported target, and identify the exact revision. Independently installed dependencies retain their upstream security policies; report Orient's integration vulnerabilities here. This policy does not promise an acknowledgement deadline or a bounty.

The maintainer reviews reports privately, investigates impact, and coordinates a fix and disclosure with the reporter. Agree on public disclosure timing before publishing details. A report is not authorization to access others' accounts, extract private data or disrupt systems.