Report security issues to daniel@clawql.com. Include reproduction steps, affected versions, and impact if known.

Please do not open public GitHub issues for undisclosed vulnerabilities.

We will acknowledge receipt, assess impact, and coordinate disclosure when a fix is available.

Published scan history, SBOM links, and signature verification commands:

https://docs.clawql.com/security/status

That page is fed by CI artifacts and an append-only publish job — not hand-edited summaries.

• Security overview (docs)
• Golden image pipeline
• npm supply chain