For upgrade, rollback, and clean-room disaster recovery instructions, see docs/operations.md.

Please do NOT report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Instead, please report suspected vulnerabilities privately via GitHub Private Vulnerability Reporting (Security Advisories).

• The git-agecrypt --version and platform/OS (Linux, macOS, Windows).
• A minimal reproduction script or repository fixture demonstrating the issue.
• Which security boundary or invariant is affected (see docs/security-model.md and docs/security-review-package.md).

git-agecrypt has not yet undergone a paid third-party cryptographic audit.

• All symmetric and asymmetric cryptography is delegated directly to the upstream age crate (X25519, ssh-ed25519, ssh-rsa, ChaCha20-Poly1305 STREAM) and RustCrypto (sha2, hmac).
• A comprehensive External Security Review Readiness Package documents the complete trust model, key hierarchy, data-flow diagrams, every unsafe block and OS syscall in the codebase, crash/durability invariants, and priority review questions.