The latest published release and the current main branch receive security
fixes. Pre-release APIs may change when required to close a vulnerability.
Do not open a public issue. Email security@openan.com with a description, reproduction steps, affected versions, and potential impact. Do not include real production credentials or customer data.
We aim to acknowledge reports within 48 hours and provide a fix or mitigation within 90 days. Coordinated disclosure timing will be agreed with the reporter.
- TLS certificate verification is enabled by default.
- Encrypted credentials fail closed when the key is absent or invalid.
- Full protocol payload logging is not intended for normal production use.
.env, credentials, private keys, and generated distributions are excluded from source control.