Apache Tapestry follows the Apache Software Foundation security process. Please report suspected vulnerabilities privately to [email protected] (the Tapestry PMC is reachable at [email protected]). Do not open public GitHub issues or pull requests for security reports.

What Tapestry treats as in/out of scope, the security properties it provides and disclaims (HMAC-gated serialized-state deserialization, default output escaping, asset access control, client whitelisting, secure-link enforcement), the adversary model (the untrusted web client vs. the trusted application developer/operator), and how findings are triaged are documented in THREAT_MODEL.md.