Do not file a public GitHub issue for security vulnerabilities.

Please report privately so we can fix and, if needed, coordinate a release before disclosure.

1. Open a GitHub Security Advisory on this repository (private), or
2. Email the maintainer via the address on the GitHub profile with subject
   CacheOrchestrator security: <short title>

• Affected package (CacheOrchestrator / CacheOrchestrator.Redis) and version
• Target framework and ASP.NET Core version
• Description of the issue and impact
• Minimal reproduction or proof-of-concept
• Whether the issue is already public elsewhere

• Acknowledgement when the report is received (typically within a few days)
• A fix or mitigation plan for confirmed issues
• Credit in the advisory / changelog if you want it (optional)

Use GitHub Issues with the bug template.

CacheOrchestrator configures and scopes ASP.NET Core Output Cache and FusionCache. Security-sensitive defaults include:

• Authenticated traffic is not Output-Cached by default (BypassWhenAuthenticated: true)
• Client cache is blocked for that traffic unless you explicitly opt in

Misconfiguration (e.g. caching private user data as public without per-user vary) is an application responsibility — see docs/faq.md and docs/output-cache.md.

By default the library emits X-Cache (hit/miss, domain, schedule phase). This is useful for operations and debugging but is client-visible. To disable diagnostic headers in production:

"Cache": { "EmitDiagnosticsHeaders": false }

Metrics and tracing are unaffected. See docs/observability.md.