Each Capell 1.x minor receives security fixes for at least 24 months from its release date. The latest 1.x minor remains supported while 1.x is the current major. After the next major release, the latest 1.x minor receives security fixes for at least 12 months; the existing 24-month commitment for each minor also remains in force. The end-of-life date therefore cannot be stated until the next major is released. Upgrade all installed Capell foundation packages together to the same supported release before requesting a fix.

If you discover a security vulnerability in Capell, email security@capell.app.

Include the affected package/version, a short reproduction, impact, and any relevant logs or screenshots. Do not open a public GitHub issue for an undisclosed vulnerability.

We aim to acknowledge reports within 2 business days, confirm impact and affected versions after triage, and coordinate a fix or mitigation before public disclosure.