Report suspected security vulnerabilities through Elsa Foundation's private GitHub reporting page. Keep sensitive vulnerability details out of public issues, discussions, pull requests, and other public channels.

When safe and available, include the affected Elsa version and source commit SHA, the affected component and security impact, reproduction steps, and the smallest safe proof that demonstrates the issue. Do not include credentials, tokens, secrets, personal data, or customer data; redact them from logs and proof.

No response-time SLA is offered, and this guidance does not define supported versions. For ordinary contributor questions, use Foundation Discussions Q&A. For non-security bugs or feature requests, open a Foundation issue.