Please report suspected vulnerabilities in Tidelight's public packages or services through GitHub's private vulnerability reporting feature for this repository. Do not open a public issue for an exploitable vulnerability, and do not include API keys, personal data, or production customer data in a report.

Include the affected package or service, version or commit, impact, and a minimal reproduction that uses synthetic data. Tidelight will acknowledge the report and coordinate a fix and disclosure timeline with the reporter.

This policy covers the official developer packages and Tidelight services. The Apache-2.0 license applies only to the package directories that include their own LICENSE and NOTICE files; it does not license the proprietary application or service implementation.