Strata is pre-1.0 and is developed on main. Security fixes are made against the latest main branch until versioned releases are published.

Please do not open a public issue for a suspected vulnerability. Instead, create a private GitHub security advisory with a reproduction, impact assessment, affected commit or package version, and any suggested mitigation.

We will acknowledge a report within seven days, investigate it privately, and coordinate a fix and disclosure timeline with the reporter. Please give us a reasonable opportunity to address the issue before sharing it publicly.