Flag Marshal was deprecated on 2026-10-28. No versions are supported and no further security fixes are planned. The private reporting channel below is retained for confidential disclosure; no response or remediation is promised.

Do not report vulnerabilities in a public issue, discussion, pull request, or reproduction repository.

Use GitHub private vulnerability reporting to contact the maintainers confidentially.

A private report should include:

• the Flag Marshal version (flag-marshal --version);
• the potential impact;
• minimal reproduction steps; and
• a minimal, safe demonstration where one can be provided.

Never include real flag keys, secrets, credentials, customer or personal data, or proprietary source code. No response or remediation timeline is promised by this policy.