If you find a security vulnerability in Clockwork Control, please report it privately rather than opening a public GitHub issue — email security@clockworkcontrol.com with a description and, if possible, steps to reproduce.

This is a best-effort process (see DISCLAIMER.md — there's no guaranteed SLA), but security reports are prioritized above general bug reports. You'll get an acknowledgment as soon as possible, and credit in the release notes if you'd like it, once a fix ships.

Only the latest tagged release is actively maintained. There's no long-term-support branch — if you're running an older version, update before reporting an issue tied to something already fixed.

This policy covers the Clockwork Control application itself (this repository). It does not cover the security of your own infrastructure, your own SSH/API credential hygiene, or third-party services (SpinupWP, Pressable, DigitalOcean, etc.) it integrates with.