This file defines vulnerability reporting and responsible disclosure. MAWR's technical trust boundaries and threat model are canonical in docs/SECURITY-MODEL.md.

MAWR has no runtime release. No version is currently supported for production use. This policy will be updated before the first release.

Do not publish vulnerability details in a public issue, discussion, benchmark trace, or pull request.

Use the repository host's private vulnerability-reporting feature when it is available. If no private reporting channel is published, open a public issue containing only a request for a private security contact and no technical details, exploit steps, secrets, or affected data.

Include, through the private channel:

• the affected revision or version;
• a concise impact statement;
• reproduction steps or a minimal proof of concept;
• relevant configuration and platform details;
• suggested mitigation, if known.

Maintainers should acknowledge receipt, establish a private communication channel, validate impact, coordinate a fix and disclosure timeline, and credit the reporter when requested and appropriate. Do not test against systems or data you do not own or have permission to access.