Only the latest release is actively supported. Security fixes are released as a new patch version; older versions are not back-ported.

funera is under active development. The security and sandbox features are experimental and not yet hardened — they must not be relied upon to contain untrusted code. See the README warning for details.

Anything that could compromise a host, leak secrets, or escape the configured sandbox is in scope.

Please do not open a public issue for security vulnerabilities.

Report them privately via GitHub's private vulnerability reporting. If that is unavailable, contact the maintainers directly.

Please include:

• the affected version(s);
• a minimal reproduction or a precise description of the vulnerable path;
• any relevant feature flags (security, sandbox, …);
• the impact you believe it has.

We will acknowledge your report promptly and work with you on a fix and a coordinated disclosure. Credit is given to reporters who wish it.