Security policy, vulnerability reporting, and supported versions are maintained in the repository root Security Policy.
Do not open public issues for undisclosed vulnerabilities. Use GitHub Security Advisories, or the email fallback listed in the Security Policy when advisory reporting is unavailable.
RouteMQ uses CI checks for tests, linting, formatting, typing, Bandit, dependency audit, coverage, package builds, and install smoke tests. Release workflows generate build provenance and CycloneDX SBOM artifacts.