Do not open a public issue. Use GitHub private vulnerability reporting for wayne9999/wayneos. If that feature is unavailable, contact the repository owner through the private channel listed in the GitHub profile and include:

• affected commit or version;
• reproduction steps;
• security impact;
• known mitigations;
• whether public disclosure has occurred.

Do not include real secrets, personal data, or destructive payloads.

The owner will acknowledge a report, assess severity, coordinate a fix and migration, and publish an advisory when disclosure is safe. A security fix may shorten the normal compatibility window; the advisory must explain why.

• External content and extension metadata are untrusted.
• Authentication is provider-specific; authorization is server-side and provider-neutral.
• Tenant context is explicit.
• Secrets are not committed or exported through telemetry.
• Public failures are safe and correlated with protected diagnostics.
• CI uses least privilege and immutable action references.
• GitHub secret scanning and push protection are required repository settings.
• Destructive or externally visible operations require authorization and audit.

See the threat model for trust boundaries and mitigations.

During Phase 0, only the latest commit on main receives security fixes. A version support table will be published before the first stable release.