Write to security@mesharc.dev. Please do not open a public issue for a security problem.

• We acknowledge a report within two working days and tell you what we found and when it will be fixed.
• Give us a reasonable time to fix the problem before you publish anything about it. We credit reporters who want to be credited.
• Test only against accounts you own. Do not read, change or delete anyone else's data, and do not run denial-of-service tests or automated scanners against the production API.

This policy covers every repository in this organisation, and the MeshArc service itself: the app at mesharc.dev and the API at api.mesharc.dev. The service's own policy, with how accounts, keys and crawled pages are protected, is at mesharc.dev/legal/security.

Supported versions: the latest release of each package. Upgrade before reporting a problem in an older one.