RegMark is currently pre-release. Security fixes are applied to the latest main branch until the first supported release line is declared.

Please use GitHub's private vulnerability-reporting or draft security-advisory feature for the RegMark repository. If private reporting is not enabled, open a minimal issue asking the maintainer to establish a private contact channel, without disclosing vulnerability details. Do not publish a vulnerability before coordinated disclosure. Include the affected version/commit, impact, reproduction, and suggested mitigation if known. Do not send government-registry credentials, real owner data, access tokens, or other secrets.

Expected acknowledgement is within seven days. Validation-data corrections that do not create a security impact can use the normal issue workflow in CONTRIBUTING.md.

Core validation is offline and performs no registry lookup, network request, or external file read. Input length is bounded before regex evaluation, rule patterns are precompiled and deliberately simple, and catalog state is immutable. A format match must never be treated as proof of issuance, identity, ownership, or legal status.