Graft actively maintains the latest release branch with security and bug fixes:

We take the security of Graft and the organizations using it seriously. If you identify a potential security vulnerability in Graft (including credential handling, API token exposure, or execution path traversal), please do not report it publicly via GitHub Issues.

1. Email: Send details of the vulnerability to the repository maintainer (2897144+lopes@users.noreply.github.com or via GitHub Private Vulnerability Reporting if enabled).
2. Details to Include:
   • Detailed description of the vulnerability and its potential impact.
   • Affected components, files, or CLI commands.
   • Step-by-step reproduction instructions or proof-of-concept (PoC).
   • Any suggested mitigations or patches.
3. Response Timeline:
   • Initial Acknowledgement: Within 48 hours.
   • Triage & Status Assessment: Within 7 business days.
   • Fix & Public Advisory: Coordinated with the reporter prior to disclosure.

Thank you for practicing responsible disclosure and keeping the community secure.