# Security policy
Report vulnerabilities privately through the repository's GitHub security advisory feature.
Do not open a public issue for a suspected exploitable vulnerability. Include the affected crate
version, expected impact, and a minimal reproduction where possible.
## Boundary
Delegated verifies issuer-signed bearer capabilities against explicit host configuration. Security
depends on issuer-key custody, trustworthy `OperationContext` construction, atomic shared replay
state, durable audit handling, short token lifetimes, and secure transport.
The library does not authenticate the bearer or establish that a user is currently present.
## Supported versions
The latest non-yanked `0.2.x` release receives security fixes. Experimental `0.1.x` releases are
yanked and unsupported.
## Deployment requirements
- Treat capability tokens as secrets in transit, logs, traces, and storage.
- Resolve issuer keys only from trusted host configuration.
- Derive `OperationContext` from the operation that will execute.
- Use shared state with atomic nonce check-and-insert for multi-instance deployments.
- Persist audit events before executing an allow.
- Keep clocks synchronized and token lifetimes short.
See [the threat model](docs/THREAT_MODEL.md) for assumptions, non-goals, and residual risks.