Please report security vulnerabilities privately — do not open a public GitHub issue.

• GitHub: report a vulnerability (private vulnerability reporting is enabled on this repository), or
• Email: security@akritos.com

Include steps to reproduce and the affected version or commit.

• Acknowledgement within three business days.
• Assessment — we confirm or rule out the issue and tell you which, and keep you updated as we investigate.
• Fix — fixes land on main first.
• Disclosure — coordinated with you. We publish a GitHub security advisory once a fix is on main, and credit you unless you ask us not to. If no fix is ready within 90 days of your report, we agree a disclosure date with you rather than hold it indefinitely.

Holt handles business financial data (orders, invoices, journal entries, customer ledgers) and customer PII. Reports about authentication/authorization, data exposure, injection, or ledger integrity are especially valued.

The latest main is supported; fixes land there first.