Open Print is still preparing its first stable release. Security fixes are made on the current 1.0 development branch; there is no supported older release line yet.

Please use GitHub's private vulnerability reporting for this repository. That keeps exploit details out of public issues while a fix is being prepared. If private reporting is unavailable, open an issue titled Security contact request without technical details, private records, credentials, or signing material. A maintainer can then arrange a private channel.

Useful reports include the smallest record or script that demonstrates the problem, the Open Print version or commit, the expected result, the actual result, and a short account of the likely impact. Never include a real issuer private key. A newly generated test key is enough for a reproduction.

Good-faith research against your own records and local installations is welcome. Do not test against someone else's service, try to obtain private collector data, or disrupt a gallery or artist system.

Examples include:

• a changed certificate, registry event, checkpoint, or archive being accepted as intact;
• a signature being accepted for the wrong issuer, key, record, or validity period;
• duplicate certificate identities or edition sequences being committed;
• a rollback or checkpoint fork going undetected when the verifier has the required earlier checkpoint;
• path traversal, unsafe overwrite, or lock bypass in the Node file store;
• private signing material or private collector labels entering public output;
• a release artifact that cannot be tied back to its reviewed source.

Open Print does not provide DRM, legal ownership adjudication, identity checks, payment security, hosting security, or protection for applications that expose their private signing keys. Those boundaries are described in docs/THREAT_MODEL.md.

Please allow time to reproduce the issue, understand whether existing records are affected, and prepare compatible fixtures and documentation. The project will credit reporters who want to be named. There is currently no bug-bounty program and no guaranteed response window.