Only the latest active release on main is supported for security updates:

Do not open a public GitHub issue for undisclosed security vulnerabilities.

Submit a private report via GitHub Security Advisories.

If that link returns 404, private vulnerability reporting is not enabled yet — ask a repo admin to turn on Settings → Code security → Privately report a security vulnerability, then retry the link above.

security@fidusgate.io is not a working inbox: the fidusgate.io domain has no public DNS/MX records. Do not use it until this policy is updated with a verified address.

Include reproduction steps, impact, and affected components where safe. We aim to acknowledge within 72 hours and coordinate remediation under a 90-day responsible disclosure window before publishing details.

Thank you for helping keep FidusGate secure.