Security fixes are prioritized for the latest published release on main.

Do not open public GitHub issues for security vulnerabilities.

Report privately to:

• support@asoba.co

Please include:

1. Affected component (schema, transform, runtime, tooling).
2. Reproduction steps or proof of concept.
3. Impact assessment.
4. Suggested remediation (if available).

• Initial acknowledgment: within 3 business days.
• Triage and severity assessment: within 7 business days.
• Remediation timeline: communicated after triage.

We aim for coordinated disclosure:

1. Confirm issue.
2. Prepare fix and tests.
3. Publish patch release and notes.
4. Publicly disclose once remediation is available.