This policy covers every public repository and published package of the Zarel organization.
Email security@zarel.ai with a description, the affected package or repository and version, and the steps to reproduce. Please do not open a public issue for a vulnerability.
We will acknowledge the report, keep you informed while we work on it, and credit you in the release notes if you want to be credited.
In scope: the packages published under @zarel-ai on npm and the code in this organization's public repositories. The audit verifiers (@zarel-ai/audit-chain, @zarel-ai/audit-tsa) are the most sensitive: a bundle that verifies when it should not is a vulnerability.