If you discover a security issue in @workspacejson/spec, @workspacejson/rules, or the workspace.json specification itself, report it privately through this repository's security advisory form.

Do not open a public issue for a sensitive vulnerability before coordinated disclosure.

Both packages are released as a fixed group and always carry the same version. Fixes are made on the current release family; there is no long-term-support branch, and claiming one would be inaccurate.

• a short summary of the issue
• the affected package, schema path, or API surface
• reproduction steps
• whether the issue affects published packages or only local development
• whether the issue affects the normative schema or only reference behavior

• public issue reports for sensitive vulnerabilities before coordinated disclosure
• secrets, tokens, or private repository data

This repository owns the specification, schema, types, validation semantics and deterministic rules. Issues in repository generation belong to workspacejson/cli; issues in host adapters belong to workspacejson/integrations; issues in the published website belong to workspacejson/site.

@workspacejson/spec and @workspacejson/rules are currently published from workspace-json/agents-audit. Until that authority transfers, coordinate any security release with that repository.