Security fixes are provided for the latest published minor release. Upgrade before reporting an issue that is already fixed on main.

Use GitHub's private Report a vulnerability flow for this repository. Do not open a public issue for prototype pollution, path traversal, arbitrary code execution, data corruption, lock bypass or another issue that could put users at risk.

Include the affected version, storage configuration, minimal reproduction, impact, and whether untrusted input is required. You should receive an acknowledgement within seven days. Please allow time for a fix and coordinated release before public disclosure.

SencilloDB is an embedded library, not an access-control boundary. The application owns filesystem permissions and must ensure that every writer uses the same locking policy. Network filesystems are unsupported. See Concurrency and Crash Safety and Recovery.