The latest published release is v1.0.0-rc.3. See the published artifact verification. It is a release candidate. There is no Stable release or Stable support commitment.

Please report a suspected vulnerability privately instead of opening a public issue, so it can be assessed before it is disclosed.

Use the repository's private security channel GitHub Security Advisories and include:

• The affected package and the exact branch/commit you tested.
• A minimal reproduction (entry point, environment, and observations).
• Your suggested impact/severity assessment if you have one.

Because this is a pre-release, do not assume a fix exists for a numbered Stable version; the maintainers will coordinate fixes on the development branch and identify the affected release line in the security advisory.

Security-relevant issues include runtime behavior that can lead to incorrect eligibility decisions, data integrity or persistence failures, privacy/access problems for stored rules or the Host database, and vulnerable build or distribution tooling. This package trusts the Host database connection it is given and the Subjects/Contexts it evaluates; problems caused by misconfigured Host integration are not package vulnerabilities.

Coordinated public disclosure of a confirmed vulnerability happens only after a fix has been prepared and communicated to reporters, consistent with the Maatify disclosure practice.