Report suspected vulnerabilities privately via GitHub's private vulnerability reporting — please do not open a public issue. Expect an initial response within a week.

Only the latest released 0.x version receives fixes.

glidepath is a local desktop application: it transmits nothing and runs no network services. The security-relevant surfaces are the plan file parser (.glidepath.json), the shipped region data files, and the supply chain.

• Dependencies are locked with hash verification against PyPI only; no dependency may be locked to a version published within the last 7 days (see CLAUDE.md for the full policy).
• GitHub Actions are pinned to commit SHAs; Dependabot alerts on security advisories only (routine pin refreshes are manual, under the same 7-day cooldown).
• Releases are built and smoke-tested in CI, then published to PyPI via trusted publishing (OIDC, no stored credentials) with PEP 740 attestations.
• The lockfile is audited for known CVEs (pip-audit) on every CI run.