Please do not disclose security vulnerabilities in a public issue. Use GitHub's private security advisory flow for this repository, or contact the Coline security maintainers through the private security contact configured on the repository.

The SDK mirror contains public app-authoring contracts. Vulnerabilities in Coline's runtime, control plane, hosted execution, or data services must be reported privately because their fixes are maintained in the private source repository.

Supported versions: the latest published minor line. We acknowledge reports as soon as practical, investigate privately, and publish coordinated fixes when appropriate.