Please report security issues privately through GitHub:

1. Open the repository's Security tab.
2. Choose Report a vulnerability to open a private advisory.

Do not open a public issue, pull request, or discussion for a suspected vulnerability.

Useful details:

• the affected component (phase3-binary/ provider CLI or Malibu app, phase4-coordinator/, phase5-gateway/, phase7-verify/, installer, or release tooling) and version or commit;
• steps to reproduce, or a proof of concept;
• the impact you expect (for example credential exposure, billing or settlement manipulation, receipt forgery, or provider impersonation).

We review each report and follow up through the private advisory.

In scope:

• the provider CLI, Malibu app, and installer (get.malibu.tech/install.sh);
• the coordinator (coordinator.malibu.tech) and buyer gateway (api.malibu.tech);
• receipt signing and verification (macprovider-verify);
• release signing, update, and catalog feeds.

Out of scope:

• denial of service by volume against production endpoints;
• findings that need a compromised provider Mac or operator host;
• reports from automated scanners without a demonstrated impact.

Security fixes land on main and are intended to ship in a following provider CLI or service release; fixes target the latest release.

Never commit API keys, private keys, payout keys, .env files, buyer prompts, provider tokens, or receipt bundles with private contents. If you find a secret in this repository, report it through the private channel above.