Report security vulnerabilities to security@domyn.com.

Please do not open a public GitHub issue, discussion or pull request for a security report.

Include whatever you have:

• the version or commit affected
• the kind of issue — credential exposure, remote code execution, privilege escalation, denial of service, and so on
• steps to reproduce, and a proof of concept if you have one
• the impact, and how an attacker would reach it

We aim to acknowledge reports within five working days and will keep you updated while we investigate. When a fix ships we will credit you in the release notes unless you would rather we did not.

sdag is pre-1.0 and under active development. Security fixes land on main and in the next release; we do not backport them to earlier tags.