Security Policy & Continuous Release Philosophy
The Framework M Software Foundation takes the security of Framework M and its ecosystem seriously. We operate a high-trust, continuous security and update model designed to eliminate the traditional "Upgrade Tax" paid by enterprise applications.
The Continuous Rolling Release Model
Framework M does not maintain long-lived version forks (such as legacy v13 or v14 branches) or offer the false sense of security associated with static LTS (Long-Term Support) versions.
- Eliminating the False Safety of LTS: Static LTS releases often stagnate, accumulating hidden security vulnerabilities and backporting complexity. Downstream applications end up locked into old versions due to fear of breaking upgrades.
- Hexagonal Architecture (Ports & Adapters): Core domain business logic interacts strictly through stable Protocol interfaces (Ports). Internal implementations (Adapters) can be continuously refactored, optimized, or patched without breaking your application code.
- Automated Scanning & Pull Requests: Dependencies and kernel updates are scanned continuously. Automated pipelines generate non-breaking Merge Requests and verify software integrity using automatically generated Software Bill of Materials (SBOMs).
- No Blocking Upgrades: Downstream enterprise applications can update continuously with zero-downtime schema sync (ZDM) and backwards-compatible Protocol deprecation windows.
Supported Versions
Security updates and patches are continuously integrated and published directly to our active release pipeline:
| Target | Status | Distribution Strategy |
|---|---|---|
Main Branch (main) | ✅ Supported | Continuous Rolling Releases via Automated CI/CD |
Reporting a Vulnerability
If you discover a security vulnerability in Framework M core packages or studio tools, please report it privately:
- Confidential GitLab Issue: Submit a confidential report via our GitLab Issues Tracker with the Confidential checkbox selected.
- Direct Security Email: Alternatively, email details to security@frameworkm.dev.
Please do not publicly disclose the issue until our security maintainers have investigated and released a patch.
Response & Disclosure Process
- Acknowledgement: Received reports will be acknowledged within 48 hours.
- Fix & Release: Critical vulnerabilities are patched in a dedicated security release window before public release notes are published.
- Credit: Researchers who responsibly disclose security flaws will be credited in our release security announcements.