To report a security vulnerability, use GitHub's private vulnerability reporting:

1. Go to the HAPTIC security page
2. Select Report a vulnerability

Include in your report:

• A description of the vulnerability
• Steps to reproduce the issue
• The potential impact

We will acknowledge your report within 72 hours and aim to release a fix within 30 days for critical issues. Please do not disclose the vulnerability publicly until a fix has been released.

Security fixes are applied to the latest stable release only.

All release artifacts are signed with Cosign using keyless OIDC. See Supply Chain Security for instructions on verifying signatures and inspecting SBOM attestations.