MessageFlow follows Semantic Versioning. Security fixes are released for the latest minor release of the current major version, and for the last minor release of the previous major version for six months after a new major version ships.

All four ports (MessageFlow on NuGet, io.github.charles2ke:messageflow on Maven Central, messageflow on PyPI and @charles2ke/messageflow on npm) share the version number and are patched together, even when only one port is affected.

Report suspected vulnerabilities privately through GitHub: Report a vulnerability. Do not open a public issue, pull request or discussion for a suspected vulnerability.

Please include, as far as you can determine them:

• the affected port and version, and the runtime (.NET, JVM, Python or Node) it was observed on;
• a description of the impact and the smallest reproducer you have;
• any suggested mitigation.

Accepted reports are fixed on a private fork, released as a patch version of every affected port and published as a GitHub Security Advisory with a CVE requested through GitHub. Reporters are credited in the advisory unless they ask not to be. Declined reports are closed with an explanation; if you disagree with the assessment, reply on the advisory and it will be reconsidered.

Please give the maintainers the disclosure window above before publishing details. There is no bug bounty for this project.

In scope: the library code of the four ports in src/, java/, python/ and node/, the release workflows that publish them, and the published packages themselves.

Out of scope: the documentation site in docs/ (a static page that runs the JavaScript port entirely in the browser and stores no data), the samples and benchmarks, vulnerabilities that require an attacker to already control the handlers composed into a chain, and findings that only apply to unsupported versions.

MessageFlow composes handler delegates; it does not parse untrusted input, perform I/O, spawn processes, or read configuration or environment variables. Every port ships with zero runtime dependencies, so the transitive attack surface of adopting it is the library itself.

• Requests and responses are passed through unchanged; nothing is copied, cached or serialised.
• No telemetry is collected and nothing is sent over the network. The optional UseLogging decorator only emits to the sink the application provides. UseTracing emits on a caller-supplied tracer interface in Java, Python and Node; in C# it emits on the library-created ChainDiagnostics.ActivitySource, and the application only subscribes listeners/exporters to it. What they emit is described in ENTERPRISE.md.
• A chain is immutable once built and safe to share across threads; handlers supplied by the application must be thread-safe themselves.
• Exceptions thrown by handlers propagate unchanged, including their messages and stack traces, so applications remain responsible for redacting anything sensitive before it reaches a log sink.

CodeQL (security-extended) over the C#, Java, Python and TypeScript sources, and the .NET CI build, run on push and pull requests targeting main. Dependency review runs on pull requests only. OpenSSF Scorecard runs weekly and on push to main. A vulnerable-package audit currently covers the NuGet ecosystem only (dotnet list package --vulnerable --include-transitive in CI). Releases are built by GitHub Actions with pinned workflow permissions, and ship an SBOM and a signed build provenance attestation for the .NET, Java and Python artifacts (the npm artifact uses npm publish --provenance instead). See ENTERPRISE.md for the full list and for how to verify the artifacts you consume.