Strongroom is pre-1.0 software that handles encryption keys and third-party credentials. It has not had an independent security audit; see docs/security.md for its threat model and boundaries.

Report vulnerabilities privately through GitHub security advisories. Do not open a public issue. Include the affected version or commit, the impact, and steps to reproduce. Never include real credentials, plaintext secrets or production envelopes.

Before 1.0, only the latest release and main receive fixes.