# Security policy

Report vulnerabilities privately through the repository's GitHub security advisory feature.

Do not open a public issue for a suspected exploitable vulnerability. Include the affected crate
version, expected impact, and a minimal reproduction where possible.

## Boundary

Delegated verifies issuer-signed bearer capabilities against explicit host configuration. Security
depends on issuer-key custody, trustworthy `OperationContext` construction, atomic shared replay
state, durable audit handling, short token lifetimes, and secure transport.

The library does not authenticate the bearer or establish that a user is currently present.

## Supported versions

The latest non-yanked `0.2.x` release receives security fixes. Experimental `0.1.x` releases are
yanked and unsupported.

## Deployment requirements

- Treat capability tokens as secrets in transit, logs, traces, and storage.
- Resolve issuer keys only from trusted host configuration.
- Derive `OperationContext` from the operation that will execute.
- Use shared state with atomic nonce check-and-insert for multi-instance deployments.
- Persist audit events before executing an allow.
- Keep clocks synchronized and token lifetimes short.

See [the threat model](docs/THREAT_MODEL.md) for assumptions, non-goals, and residual risks.
