OpenAPI Guard was deprecated on 2026-10-28. No versions are supported and no further security fixes are planned. Private disclosure guidance below is retained for confidentiality; no response or remediation is promised.

Do not report vulnerabilities in a public issue, discussion, pull request, or reproduction repository.

Use GitHub private vulnerability reporting to contact the maintainers confidentially.

A private report should include:

• the affected OpenAPI Guard product and version;
• the potential impact;
• minimal reproduction steps; and
• a minimal, safe demonstration where one can be provided.

Never include license keys, secrets, credentials, customer or personal data, proprietary source code, or private OpenAPI contracts. No response or remediation timeline is promised by this policy.