Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report Microsoft security vulnerabilities through the Microsoft Security Response Center reporting portal. Include the affected component, version or commit, reproduction steps, impact, and any suggested mitigation. Do not include real personal or customer data.

If you are unsure whether an issue is a security vulnerability, use the MSRC portal and allow the security team to triage it.

This accelerator is under active development. Security fixes are applied to the default branch. No separate long-term-support branches are currently maintained.

This repository is a reference implementation. Adopters are responsible for threat modelling, identity integration, data classification, network isolation, key and secret management, secure software supply chain, penetration testing, monitoring, incident response, backup, recovery, and regulatory compliance in their deployment.

See Security for known sample boundaries and the production checklist.