Please do not report security vulnerabilities through public GitHub issues, pull requests, or discussions.

Use GitHub's private vulnerability reporting flow for this repository:

• https://github.com/Agent-Card/ai-catalog-go/security/advisories/new

If private reporting is not available to you, contact the project maintainers privately through GitHub and request a secure channel before sharing sensitive details.

When reporting a vulnerability, please include:

• the affected package, component, or workflow
• reproduction steps or a proof of concept
• the expected security impact
• any known mitigations or suggested fixes

Security fixes are provided on a best-effort basis for the default branch.

Security reports are especially relevant for:

• catalog parsing, identity binding, and JCS canonicalization
• digest parsing and verification in the trust package
• catalog validation and conformance-level detection
• remote catalog retrieval in the provider package
• GitHub workflows and release automation
• any repository content that could affect integrity, provenance, or disclosure

The maintainers will try to:

• acknowledge receipt promptly
• validate and triage the report
• coordinate remediation and disclosure timing when appropriate

Please avoid public disclosure until a fix or mitigation is available.