Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository and include:

• affected revision;
• reproduction steps;
• expected impact;
• any known mitigation.

You should receive an acknowledgement within five business days.

Until the first stable release, only the latest revision of main receives security fixes.

Reconduit treats tenant isolation, uploaded content, generated reports, and reconciliation decisions as security-sensitive. Source payloads, credentials, access tokens, and personal data must never be written to logs or traces.

Pull requests run locked restores, deterministic formatting/builds, backend and frontend tests, container builds, dependency review, and Gitleaks. CodeQL also runs when GitHub Code Scanning is available, including when the repository is public. NuGet and npm vulnerability audits fail the quality workflow. Actions are pinned to immutable commits. Dependency upgrades are reviewed and proposed deliberately by maintainers.

Passing automation is necessary but not sufficient. Follow the release checklist, including tenant isolation and Entra adversarial smoke tests, before creating a release tag.