Please do not report vulnerabilities through public issues or discussions.

Use GitHub's private vulnerability reporting for notzenco/axio.

Include affected versions, reproduction steps, impact, and any suggested mitigation. Do not include live credentials or private user data.

Pre-1.0.0 builds receive security fixes on the current development line.

The current trust boundaries, required controls, non-claims, and known dependency alert are documented in docs/security-model.md.