Security fixes are made against the current 0.x release line of Sterling.

Please do not report a potential vulnerability in a public GitHub issue.

Use GitHub private vulnerability reporting and include:

• a concise description of the issue;
• affected Sterling version and runtime/framework details;
• reproduction steps or a minimal proof of concept;
• potential impact; and
• any suggested mitigation, if known.

If private reporting is unavailable, open a public issue titled Security: private contact requested without technical details. The maintainer will arrange a private channel.

We will acknowledge a report, investigate it, and coordinate a fix or disclosure timeline as appropriate for the impact.