Security fixes are applied to the latest stable v1 release and main. Additional supported release lines and end-of-support dates will be documented here when offered.

Use GitHub private vulnerability reporting for this repository. Include a minimal reproducer, expected and observed behavior, affected versions, impact, and any suggested mitigation. Do not include secrets or production data.

Maintainers will acknowledge the report, reproduce and assess it privately, coordinate a fix and advisory, and credit the reporter when requested. Public disclosure should wait until a fix or agreed mitigation is available.

Job payloads, broker frames, retry metadata, and backend state are untrusted operational inputs. Settlement correctness, bounded retries, and deterministic shutdown are part of the maintained security boundary.

Applications remain responsible for transport limits, authentication, authorization, rate limiting, deadlines, secret handling, deployment policy, and business-level validation. Package safeguards do not replace those controls.

See docs/security.md and docs/failure-model.md for adoption guidance and the maintained security boundary.