EgressWeave is a security boundary for outbound HTTP, so vulnerability reports are handled as coordinated disclosures rather than ordinary bug reports.

Only the latest minor release receives security fixes. Upgrade to the newest published version before reporting behavior that may already have been corrected.

Use GitHub's private Report a vulnerability flow on this repository. If that control is unavailable, open a public issue containing only Security contact requested and no technical details; a maintainer will establish a private channel. Do not place exploit details, private addresses, credentials, production traffic, or an executable proof of concept in a public issue, pull request, discussion, fork, or test repository.

A useful private report includes:

• the affected EgressWeave version and Python version;
• the exact policy and URL shape, with secrets and real internal hosts replaced;
• whether the issue affects validation, DNS pinning, TLS authority, redirects, proxies, local-development exceptions, or packaging;
• a minimal reproducer that does not contact third-party systems;
• the security impact and any known preconditions;
• suggested remediation or standards references, when available.

Maintainers aim to acknowledge a complete report within three business days, provide an initial severity assessment within seven business days, and post a status update at least every fourteen days until resolution. These are targets, not guarantees; complex resolver, TLS, or dependency issues may require coordinated upstream work.

Confirmed vulnerabilities are fixed on a private branch, assigned a CVE or GitHub Security Advisory when appropriate, tested against supported Python versions, and released before public technical details are disclosed. Credit is offered unless the reporter requests anonymity.

Please allow maintainers a reasonable remediation window before publication. Immediate public disclosure may be necessary only when exploitation is already widespread and withholding details would create greater harm. Maintainers will coordinate publication timing and clearly identify fixed versions and upgrade guidance.

Read docs/security-model.md before filing a report. It defines the enforced invariants, trust boundaries, local-development exception, and behaviors that remain the embedding application's responsibility.