Please do not open public issues for security vulnerabilities.

Report privately via GitHub Security Advisories. You will receive an acknowledgement within 72 hours and a status update as the report is triaged.

The self-hosted platform (api, worker, web), the published @flakemetry/* packages, and the GitHub Action. A dedicated threat model and hardening pass is tracked for the SaaS milestone.

Pre-1.0: only the latest published version of each package receives security fixes.