Charon is pre-release security software. Do not place production credentials in it until the relevant milestone is explicitly marked production-ready.
Report vulnerabilities privately through GitHub's security-advisory interface
for ak5/charon. Do not open a public issue containing exploit details,
credentials, request captures, vault exports, or authentication headers.
The current security invariants and known limitations are maintained in
docs/threat-model.md.
The latest owner audit, remediated findings, residual risks, and production
release gate are recorded in
docs/security-audit-2026-07-27.md.