Please report vulnerabilities privately through GitHub Security Advisories. Do not open public issues for security reports.

You will receive an acknowledgment within 3 business days.

This policy covers the published library modules and TCK, including their shipped classifiers. The examples/ applications are demonstration code and are out of scope.

The release-candidate workflow resolves the actual publication runtime graphs, checks SBOM completeness (including shaded Caffeine and published test fixtures), and scans them with a checksum-pinned Trivy binary. Unexcepted HIGH/CRITICAL findings and incomplete or failed scans reject acceptance. Any checked-in exception must name the exact vulnerability/artifact/version, owner, rationale and future expiration date; exceptions require maintainer review.

The complete candidate evidence bundle is signed with Sigstore and receives GitHub build provenance. Its manifest binds binaries, classifiers, publication metadata, SBOMs and scan results to their exact SHA-256 bytes and source commit. Final-mode evidence is retained with an existing GitHub release; ordinary SNAPSHOT development and trial workflows remain allowed.

See release evidence for the precise scope, scanner self-test, exception policy, commands, signature verification and comparison with Central downloads. A separately rebuilt artifact is not covered by the candidate attestation unless its checksum matches. No historical release is retroactively claimed to have passed this new evidence gate.

The recorded trial is dated evidence for a specific commit, not acceptance of a future release. Application BOMs can override library versions; functional compatibility checks in the platform matrix do not replace scanning the final application dependency graph.