The project is currently on the 1.x line. A report should identify the exact commit hash, compiler version, OpenSSL version, and build configuration.

Do not disclose potential integrity-bypass, memory-safety, manifest-parsing, or cryptographic-binding vulnerabilities in a public issue before coordinated handling. Use the repository's private GitHub security-reporting channel after publication, or contact the maintainer identified in repository metadata. Include a minimal reproducer, platform, toolchain, and expected versus actual behavior.

HRCC uses SHA-256 commitments to detect a record modification, deletion, reordering, or metadata substitution relative to a trusted root digest. HRCC does not sign the root, establish identity, protect confidentiality, or provide replay or downgrade protection. The surrounding protocol must provide those properties.

A production deployment must bind the root and manifest through an external trusted mechanism, such as a digital signature, append-only transparency log, trusted timestamp, authenticated database transaction, or an equivalent control.

Run CTest in both Release and sanitizer profiles before changing the core. Any change to canonical encoding, domain tags, or manifest semantics affects the format and requires an explicitly versioned scheme. Existing format semantics must not change implicitly.