Security fixes are made on the current release line and on main. Older release lines do not receive backports.

Please do not open a public issue for a suspected vulnerability. Use GitHub's Private vulnerability reporting form instead. Include the affected version, a small reproduction, the expected impact, and any workaround you have found.

You should receive an acknowledgement within seven days. The maintainers will confirm the scope, discuss a disclosure date with you, and prepare a fix before publishing details. If the report does not affect CherubSH, the response will explain why.

Starting with v0.4.0, each tagged release includes SHA-256 checksums, CycloneDX SBOM files, and GitHub artifact attestations. The README contains the verification commands. A valid attestation proves which repository and workflow produced an asset; it does not replace review of the source or the SBOM.