None yet. marstack-access is pre-release, has no tagged releases, and should not sit in front of anything you care about.

Open a private security advisory through GitHub on this repository. Please do not open a public issue for a vulnerability.

Include what you did, what happened, and what you expected. A reproduction against a local deployment is the most useful thing you can send.

Findings that let a session reach a target outside its grant, land as a principal it was not granted, open without being recorded, or continue after its grant is revoked are the highest severity in this project.

See docs/SECURITY.md for the threat model, the invariants the code is expected to hold, the rules that apply to connection and cryptographic code, and the scanners that run on every commit.