Report vulnerabilities privately through GitHub Security Advisories. Do not open public issues containing exploit details. Include affected version, reproduction steps, impact, and suggested remediation when possible.

Only the latest release receives security fixes. Gatehouse validates artifact policy; it does not verify cryptographic signatures or establish publisher identity. See the threat model before deploying it as a security boundary.