Please report security issues privately to the A3S Lab maintainers via GitHub Security Advisories for A3S-Lab/Gateway when available, or by contacting the maintainers through the organization security channel. Do not open a public issue for undisclosed vulnerabilities.

Include: affected version, reproduction steps, impact, and any proof-of-concept that stays within legal test environments you own or are authorized to test.

Gateway is a local data plane. Cloud control-plane, Power observation delivery, and Box/MicroVM substrates have their own boundaries — see docs/threat-model.md and ROADMAP.md.