Flowatch is under active beta development until v1.0.0; security fixes target the latest release branch.

Do not open public issues for security bugs.

Report privately via Github private vulnerability disclosure feature

Maintainers aim to acknowledge reports within 14 days and ship a fix or mitigation within 90 days.

• Application code in this repository
• Build & release workflows

Out of scope: third-party dependencies (report upstream where applicable).

We prefer coordinated disclosure. After a fix, we credit reporters unless requested otherwise.