This policy covers the current main branch of peerweave: framework packages and lightweight examples. The project is a preview; no LTS branch, historical-version support or response SLA is promised. Use the latest reviewed source and pinned dependency/image updates. Source availability does not mean every browser, device or deployment environment has been validated.

Use GitHub private vulnerability reporting. Do not open a public issue or PR that discloses an exploitable vulnerability before coordination.

Include the affected commit/version, impact, minimal reproduction, prerequisites and suggested mitigation if known. Share only synthetic/redacted evidence: never real TURN secrets, credentials, TLS keys, tokens, private network inventories, user media or personally identifying data. Maintainers will investigate and coordinate fixes/disclosure as resources permit.

Ordinary non-sensitive bugs belong in Issues. Do not test against infrastructure or participants you do not own or have permission to test.