Security issues should be reported privately whenever possible.

Examples include vulnerabilities that could affect applications using OrafitSQL, such as:

• SQL transformation that can cross an intended trust boundary;
• unsafe handling of JDBC connection data, credentials, or parameters;
• dependency or packaging behavior that could execute untrusted code unexpectedly;
• release or build integrity problems that could cause users to consume modified artifacts;
• denial-of-service behavior that is practical to trigger through normal OrafitSQL inputs.

Ordinary compatibility differences, unsupported Oracle syntax, and migration questions are not security vulnerabilities unless they create a concrete security impact.

Security fixes are made on the current development line and, after releases exist, the current supported release line. Older prereleases or superseded versions may require upgrading to receive a fix.

1. Prefer GitHub's Report a vulnerability / private vulnerability reporting flow when it is available for this repository.
2. Do not include exploit details, credentials, customer SQL, or other sensitive information in a public issue.
3. If private vulnerability reporting is not available, open a public issue titled Security contact requested containing only enough information to request a private channel. A maintainer will arrange follow-up before technical details are shared.

A useful private report includes the affected version or commit, impact, reproduction steps, prerequisites, and any suggested mitigation. Please minimize real credentials and production data in reproductions.

Maintainers will acknowledge a valid private report, reproduce and classify the issue, prepare a fix and regression test when appropriate, and coordinate disclosure after a safe update path exists. Exact timing depends on severity and the complexity of the fix; the project does not promise a fixed response SLA.

Security fixes still follow OrafitSQL's fail-closed compatibility policy. A safe temporary rejection is preferable to silently preserving unsafe behavior.