No released version receives a security-maintenance guarantee. Accepted fixes land on the main branch.

Report suspected vulnerabilities privately through a GitHub security advisory ("Report a vulnerability" under the repository's Security tab), not in a public issue. Include enough detail to reproduce the problem where possible.

Reports are acknowledged as promptly as we can manage, and any fix and disclosure are coordinated through the advisory. There is no bug bounty program.

A SparkRing deployment's model API has no authentication and listens on every interface of the Spark that serves it. Setup also adds an administration network and SSH service. The install guide and the install reference describe what is exposed and how to restrict it.