Guardplane is developed in the open. Security fixes are expected to land on the latest release line and the default branch first.

Do not report vulnerabilities through public issues or public pull requests.

Preferred path:

1. Use private vulnerability reporting on the repository host if it is enabled.
2. If private reporting is not available, contact the project maintainers through the private security contact configured for the repository host.

Include the following when possible:

• affected version or commit
• deployment mode (sqlite or postgres, local, docker, or bwrap backend)
• reproduction steps or proof of concept
• impact assessment and expected guardrail bypass
• whether the issue affects bridge, contained, remote workers, or control-plane APIs

The maintainers will try to:

• acknowledge receipt within 5 business days
• reproduce and scope the issue
• prepare a fix or mitigation before public disclosure when feasible
• publish release notes for material security fixes

Guardplane is a policy-enforcing runtime kernel. Some modes intentionally trade isolation strength for compatibility.

• bridge is not process isolation.
• contained and hardened backends provide stronger control, but they are still not equivalent to a general-purpose operating-system security boundary.
• Misconfiguration of tokens, worker trust, or external sinks is in scope when it changes the product's security posture.