Security Policy

Supported versions

Astral is pre-1.0 and under active development. Security fixes are applied to main (or the default branch). If/when release branches exist, this document will be updated with an explicit support matrix.

Reporting a vulnerability

Please report security issues through GitHub's private vulnerability reporting form under the repository's Security tab. Do not open a public issue with vulnerability details.

Include: - A clear description of the issue and impact - Reproduction steps / PoC (if available) - Affected platform(s), build preset(s), and commit SHA - Any suggested fix or mitigation

If the private reporting form is unavailable, open an issue containing no technical details and ask the maintainers to enable a private disclosure channel.

Disclosure process

1. Triage and confirm the issue.
2. Develop a fix and add regression coverage when practical.
3. Coordinate disclosure timing (especially for downstream engine/plugin consumers).
4. Publish an advisory and release notes when a tagged release process exists.