OMP Session Gateway is a qualified beta, not a stable or production-qualified service. Use only the exact host/client/deployment combinations advertised in docs/COMPATIBILITY.md; do not expose the loopback backend directly, enable Tailscale Funnel, use Portal Tunnel or another forwarder, or treat an unqualified platform or background Web Push as supported.

Please report suspected vulnerabilities privately through this repository's GitHub Security Advisories. Do not open a public issue containing:

• collaboration links or URL fragments;
• publisher tokens;
• transcript content;
• Tailscale identity details;
• filesystem paths that reveal private project names; or
• exploit steps that would put current users at immediate risk.

If GitHub Security Advisories is unavailable, contact @alphastorm through a private channel listed on the maintainer's GitHub profile.

Include the affected version/commit, deployment mode, impact, minimal reproduction, and whether any bearer capability or transcript data may have been exposed. Redact all live secrets and use synthetic fixtures.

The volunteer-maintainer response targets are:

• acknowledge within 3 business days;
• provide an initial severity assessment within 7 business days; and
• coordinate disclosure after a fix or mitigation is available.

These are goals, not a service-level guarantee for a volunteer project.

The detailed threat model, trust boundaries, and release gates are in docs/SECURITY.md. Changes to authentication, capability handling, IPC, browser storage, logging, or OMP lifecycle must update that document and include security-focused tests.

v0.1.0-beta.1 is the current qualified beta; v0.1.0-alpha.1 is its gateway rollback predecessor. OMP must be restored separately to the matching exact alpha patch before sessions restart; no paired rollback is claimed. Neither release is a stable-production support promise. Supported combinations, known limitations, and release-specific evidence are maintained in docs/COMPATIBILITY.md and docs/RELEASE_STATUS.md.