Report suspected vulnerabilities privately through GitHub's security advisory form. Do not include exploit details, credentials or private application data in a public issue. Include the affected package and exact version, a minimal reproduction, the expected trust boundary and the observed impact. Redact sensitive data.

This repository maintains marionette and the @mnjs/data, @mnjs/adapters, @mnjs/utils and @mnjs/radio packages. Maintainers review private reports and coordinate fixes and disclosure through the advisory. Ordinary bugs and support questions belong in the issue tracker.

Current development targets v5, which is a release candidate. A prerelease is not a stable support commitment. Reports about older releases should identify the affected version and whether the problem reproduces on the current candidate; do not upgrade a production application solely to investigate a report. This community-maintained project does not promise a response deadline or automatic backports. A backport or supported-version window must be stated in the relevant release or advisory.

For application authors, rendering untrusted content safely describes the application's responsibilities. Reporting a vulnerability does not require demonstrating an issue in a real deployment; a minimal isolated example is sufficient.