Reporting a vulnerability

Report security problems privately to [email protected] — never in a public issue. Include what you observed, how to reproduce it, and the version (saphan version). We will confirm receipt, agree a disclosure timeline with you, and credit you unless you prefer otherwise.

One class of report we treat as more serious than a missing control: a claim in this documentation that turns out to be false — a mechanism that does not enforce what it says it does. A gap we have documented is a known risk you can plan around; a gap you believed was covered is not. We correct the documentation in the same change as the code.