Security
Understand the application trust boundary and report sensitive issues privately.
Varendo validates typed proposals and current contract state. The integrating application remains responsible for authenticated identity, source authorization, route protection, and business execution.
Report a vulnerability#
Do not post credentials, customer records, or exploit details in a public issue. Use GitHub private vulnerability reporting.
Useful evidence#
Include the exact version and entry point, smallest non-sensitive reproduction, expected boundary, observed behavior, and impact.