If you believe you have found a security vulnerability in Lucerna, please report it privately.

Preferred reporting channel: GitHub Private Security Advisory.

This goes directly to the maintainer through GitHub's private reporting workflow. The report is not visible publicly. GitHub also supports CVE assignment from the same workflow when applicable.

Please do not open public GitHub issues, pull requests, or Discussions for security reports. Doing so exposes the vulnerability before there is a fix.

• We aim to acknowledge new reports within 7 days.
• Coordinated disclosure window: 90 days by default, with an expedited timeline for actively exploited issues.
• Credit is given to the reporter in the release notes unless the reporter requests otherwise.

The full release and security policy — reproducible builds, signing, network audit, supply chain — is in docs/SECURITY.md.

Only the latest released minor version receives security fixes. Earlier versions are out of scope.

None published yet. If a maintainer GPG key is established in the future, its fingerprint and the public key will live in a KEYS file at the repository root.