Please report security vulnerabilities privately — do not open a public issue.
- Contact: https://github.com/EricSanchezok/recursive-context-machine/security/advisories/new
- Response target: acknowledgment within 3 business days; a fix plan within 10 business days.
- Scope: the software in this repository and its released artifacts.
Only the latest release receives security fixes. Older versions are patched on a best-effort basis.
We coordinate disclosure: the reporter and maintainers agree on timing before a public announcement, with credit to the reporter unless anonymity is requested.