FlowCraft is a multi-module Go workspace in pre-1.0 development. Security fixes are issued against the latest release of each versioned module.

Older minor versions are not patched; please upgrade before reporting issues that only reproduce on outdated tags.

The repository also contains:

• examples/forge — the runnable local workspace demo. It is built from the workspace and not versioned; fixes ship with the next core/driver/ backends release that the workspace tracks.

Because modules depend on core, coordinated fixes may require same-batch releases across core, driver/*, and backends/*.

Please do not file public GitHub issues for security problems.

Use one of the following private channels:

1. GitHub Security Advisories — preferred. Open a draft advisory at https://github.com/GizClaw/flowcraft/security/advisories/new. This keeps the report private and lets us coordinate a fix and CVE assignment with you.
2. Email — security@gizclaw.dev (PGP key on request).

Please include:

• Affected module(s) and version/tag (e.g. core/v0.1.0).
• A minimal reproduction (config, command, request, or code snippet).
• Impact assessment (what a malicious actor could do).
• Any suggested mitigation, if you have one.

• We acknowledge new reports within 3 business days.
• We aim to provide a triage assessment (severity, affected versions, ETA) within 7 business days.
• For confirmed high-severity issues we coordinate a fix, a CVE (when applicable), and a coordinated release window with the reporter. Reporters are credited in the advisory unless they request otherwise.

In scope:

• Code in this repository (core/, driver/, backends/, examples/forge/, tools/).
• Supply-chain and dependency issues affecting published modules.

Out of scope:

• Third-party LLM, STT, or TTS providers — please report those upstream.
• Vulnerabilities that require an attacker to already control the host running the application or the operator's developer machine.
• Best-practice hardening suggestions without a concrete attack — those are welcome as regular GitHub issues or pull requests.