As the project is currently under active development, security fixes are generally applied to the latest version on the main branch.

If you discover a security vulnerability, please do not open a public GitHub issue.

Instead:

1. Contact the maintainers privately.
2. Provide a description of the vulnerability.
3. Include reproduction steps when possible.
4. Allow reasonable time for investigation and remediation before public disclosure.

We will acknowledge receipt of vulnerability reports and work to address confirmed issues as quickly as possible.

Examples of security-relevant issues include:

• Arbitrary code execution
• Privilege escalation
• Dependency supply-chain attacks
• Credential exposure
• Unsafe deserialization
• Remote file access vulnerabilities

Thank you for helping keep coco-pipe secure.