Charon is pre-release security software. Do not place production credentials in it until the relevant milestone is explicitly marked production-ready.

Report vulnerabilities privately through GitHub's security-advisory interface for ak5/charon. Do not open a public issue containing exploit details, credentials, request captures, vault exports, or authentication headers.

The current security invariants and known limitations are maintained in docs/threat-model.md.

The latest owner audit, remediated findings, residual risks, and production release gate are recorded in docs/security-audit-2026-07-27.md.