Report vulnerabilities privately through GitHub security advisories. Include the version, impact and a minimal reproduction with credentials removed. Regular bugs belong in issues. Response times are not guaranteed.

Mooring is early-stage software, without an independent security audit. Fixes target the latest version; older versions have no separate support commitment. Trust deployment-branch writers, image publishers and local hook owners. Docker socket access grants host-level privileges. Keep credentials and Mooring's private deployment state out of public repositories and issue attachments.