Astral is pre-1.0 and under active development. Security fixes are applied to main (or the default branch). If/when release branches exist, this document will be updated with an explicit support matrix.

Please report security issues through GitHub's private vulnerability reporting form under the repository's Security tab. Do not open a public issue with vulnerability details.

Include:

• A clear description of the issue and impact
• Reproduction steps / PoC (if available)
• Affected platform(s), build preset(s), and commit SHA
• Any suggested fix or mitigation

If the private reporting form is unavailable, open an issue containing no technical details and ask the maintainers to enable a private disclosure channel.

1. Triage and confirm the issue.
2. Develop a fix and add regression coverage when practical.
3. Coordinate disclosure timing (especially for downstream engine/plugin consumers).
4. Publish an advisory and release notes when a tagged release process exists.