Open the affected repository's Security tab, choose Advisories, then Report a vulnerability to send a private report to the maintainer. Include the affected package and version, steps to reproduce, and the expected impact. Keep vulnerability details out of public issues and pull requests until a fix and disclosure are coordinated.

Richard McDaniel (@rmcdaniel) is the sole maintainer and security maintainer of Durable Workflow.

His security responsibilities include reviewing vulnerability reports, assessing security issues, developing and reviewing fixes, adding security regression tests, and coordinating security updates and disclosures.

These responsibilities cover the Durable Workflow repositories he maintains, including the core workflow runtime, orchestration server, Waterline, PHP/Python/Rust SDKs, and command-line tooling.