Membrane is an internal, workspace-coupled control plane, not a standalone public service (README). Security claims below are limited to checked source, tests, or release contracts; missing proof is marked unavailable.

Do not put secrets, exploit code, or private data in a public issue. The repository contains no published security mailbox or disclosure SLA (unavailable). Send a minimal private report to the maintainer/contact that came with your installation, including affected revision, platform, impact, reproduction, and a safe contact method. Request acknowledgement before sharing sensitive details. Do not test against another user's installation.

• Authorization is monotone: installation, caller, target, child, task, and operation levels intersect in mcp/authorization.mjs; adversarial zero-admission coverage is documented in docs/security/adversarial-authorization-suite.md.
• Scope grants are short-lived Ed25519 signatures with canonical signing bytes; implementation and tamper tests are mcp/scope-grant-v1.mjs and mcp/scope-grant-v1.test.mjs.
• Provenance is local metadata only. Recorded fields, exclusions, storage, and wipe semantics are in docs/privacy.md and the adapter (mcp/adapters/provenance/index.mjs).
• Release trust is contract-level until signed artifacts and clean-host receipts exist; see docs/security/signing-update-trust.md.

Node.js >=20 is the declared runtime floor (package.json). The current MCP protocol and client support claims are generated in docs/clients/support-matrix.v1.json; unsupported or degraded cells must not be described as fully supported. There is no separately published security-support end date (unavailable).

Documentation never upgrades a source-only claim into installed or published proof. Mac and Windows acceptance requires the receipts described in docs/release/macos.md and docs/release/windows.md.