Please report security issues privately rather than in public issues or pull requests. Use GitHub's private vulnerability reporting for this repository (Security → Report a vulnerability), or the maintainer contact listed in the PKGBUILD # Maintainer: line.

Please include enough detail to reproduce — affected version, environment, and a proof of concept where possible. You can expect an acknowledgement and an initial assessment of the report.

Fixes target the latest released version and main. There is no long-term support branch; upgrade to the newest release to receive security fixes.

Releases are GPG-signed end to end with the maintainer key:

• the release: vX.Y.Z commit and the annotated git tag are signed;
• the source tarball ships a detached signature (sysforge-X.Y.Z.tar.gz.asc) plus SHA256SUMS / SHA256SUMS.asc on the GitHub release.

The AUR sysforge package declares the maintainer key in validpgpkeys and lists the detached signature as a source, so makepkg verifies the maintainer signature at install time and aborts on mismatch. To verify manually, see the verifying releases guide. The maintainer public key (and its fingerprint) lives at keys/sysforge.asc.

Signing applies from the first release cut after this policy landed; earlier releases were published unsigned.