RequestSeal signs and verifies HTTP messages and JOSE envelopes. Its security contract, trust boundaries, and threat responses are in the threat model.
Reporting a vulnerability
Never put private keys, tokens, customer payloads, credentials, or exploitable undisclosed details into public issues, logs, notebooks, or chat transcripts.
Report vulnerabilities privately through GitHub: open the repository's Security tab and choose "Report a vulnerability," or go directly to the private report form. Only the reporter and the maintainers can see the report. Do not open a public issue for a vulnerability.
Supported releases
Releases are published on Hex. No supported-release window or response-time commitment is declared yet; the changelog records each release.
Release acceptance requires supported-release policy, dependency/advisory checks, patched artifacts, provenance, coordinated disclosure guidance, and a tested revocation/upgrade procedure. The release runbook owns those steps.