Treeze is early in development. Security fixes will generally target the latest version on the main branch unless a stable release process is introduced later.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report the issue privately to the maintainer.

Include as much detail as possible:

• Description of the vulnerability
• Steps to reproduce
• Affected files or components
• Potential impact
• Suggested fix, if known

Security-sensitive areas may include:

• Websocket message handling
• Client/server protocol parsing
• Runtime session handling
• Static file serving
• User-provided widget data
• Browser event handling
• Future plugin or extension systems

Please give the maintainer reasonable time to investigate before publicly disclosing a vulnerability.

Treeze is currently a small early-stage project, so response times may vary.