Security updates apply to the default branch (main) of dflow-sh/starters. Tags/releases will be documented as the release process matures.

Please do not open a public GitHub issue for undisclosed security problems.

Use one of these channels:

1. GitHub — Open a private security advisory for this repository (preferred when the repo exists and the feature is enabled for the org).
2. Email — Contact security@dflow.sh with a clear subject line (e.g. Security: starters — short summary). Include steps to reproduce, impact, and any suggested fix if you have one.

We will acknowledge receipt as staffing allows and work with you on a coordinated disclosure where applicable.

Reports should concern this repository (starter templates, tooling, and docs). For issues in the core dFlow engine, use the reporting channel appropriate to dflow-sh/dflow or vendor documentation.