RequestSeal signs and verifies HTTP messages and JOSE envelopes. Its security contract, trust boundaries, and threat responses are in the threat model.

Never put private keys, tokens, customer payloads, credentials, or exploitable undisclosed details into public issues, logs, notebooks, or chat transcripts.

Report vulnerabilities privately through GitHub: open the repository's Security tab and choose "Report a vulnerability," or go directly to the private report form. Only the reporter and the maintainers can see the report. Do not open a public issue for a vulnerability.

Releases are published on Hex. No supported-release window or response-time commitment is declared yet; the changelog records each release.

Release acceptance requires supported-release policy, dependency/advisory checks, patched artifacts, provenance, coordinated disclosure guidance, and a tested revocation/upgrade procedure. The release runbook owns those steps.