Security fixes target the latest released version of Orka. Older plugin cache versions are immutable snapshots and should be upgraded after a fix is released.

Please report vulnerabilities privately through GitHub private vulnerability reporting. Do not open a public issue for a suspected vulnerability.

Include, when available:

• the affected Orka version and host;
• the trust profile and execution route;
• minimal reproduction steps;
• the expected and observed authorization boundary;
• sanitized logs or state excerpts;
• whether credentials, merges, commands, repositories, or spending controls may be affected.

Never include live credentials, private repository contents, customer data, or unsanitized model transcripts. We will acknowledge a complete report as soon as practical, validate its impact, coordinate a fix, and agree on disclosure timing with the reporter.

Ordinary reliability bugs that do not expose a security boundary can use the public bug-report form.