Security fixes are provided for the latest released minor version. Older versions may be asked to upgrade before a fix is backported.

Do not disclose suspected secret leakage, authentication bypasses, request-identity spoofing, audit-log loss, log-forging vulnerabilities, or other security issues in a public GitHub Issue.

Use the repository's Security → Report a vulnerability flow to open a private report. Include:

• the affected module and version;
• a minimal reproduction or proof of concept;
• the expected and actual behavior;
• the security impact and required preconditions;
• the deployment topology and trusted-proxy configuration, when relevant;
• whether credentials, personal data, or production logs may have been exposed.

Maintainers will acknowledge a complete report, investigate it privately, and coordinate a fix and disclosure. Do not include real credentials or production personal data in the report.

UniLog provides preventive controls for field allowlisting, redaction, control-character neutralization, correlation validation, trusted proxies, bounded asynchronous queues, and separated audit output. These controls do not prove that arbitrary exception messages or application-supplied text are free of sensitive data, and they do not turn a local file into immutable evidence. Applications remain responsible for data classification, secret handling, least-privilege log access, center-side retention, and incident response.

Supported production branches receive security fixes through reviewed pull requests with tests for both Java compatibility lines and both logging backends. Public disclosure should occur only after a fixed release and an agreed remediation window.