Themis is a validation gate, so security issues include ordinary vulnerabilities and validation bypasses that could let risky code pass as safe. Themis does not certify that passing code is secure; it only reports configured blockers and evidence gaps.

Security fixes target the latest 1.x release and the default branch. Older releases may receive fixes at maintainer discretion until a formal long-term support policy exists.

Report security issues privately before publishing details.

For this GitHub-hosted repository, use private vulnerability reporting. That form stays private. Do not include exploit details in a public issue.

If you are reporting against a different Themis deployment with no private channel, open a minimal public issue that states a private security report is needed, without exploit details.

Include:

• Affected version or commit.
• Reproduction steps.
• Expected and actual validator behavior.
• Whether the issue can cause a false pass, secret exposure, command execution, or incorrect pull request creation.

• Themis must fail closed when it cannot inspect a repository safely.
• Themis must not silently ignore failed required checks.
• Themis must not create pull requests when blockers exist.
• Themis must treat secrets in diffs as hard blockers.