Security fixes are provided for the latest released minor line.

Do not open a public issue for a suspected vulnerability. Use the repository's private vulnerability reporting form and include the affected version, reproduction, impact, and any suggested mitigation. Do not include real credentials or production databases.

A WalProof plan names a program that runs with the invoking user's permissions and inherited environment. The plan and executable are trusted code. WalProof validates the plan boundary, uses an argument array with shell=False, rejects batch launchers, limits argument sizes and execution time, and supplies only generated database paths. It does not sandbox the child or its descendants.

The evidence model does not retain literal argv or exception text, and WalProof discards child stdout/stderr. This avoids copying credentials that an external command may place in those channels. Reports can still contain user-controlled plan names, output paths chosen for the report itself, and check details generated by WalProof; do not put secrets in plan names or filesystem names.

• Malicious behavior by a plan the user intentionally executed.
• Production data access, because WalProof accepts no production database path.
• Guarantees about filesystem crash durability, remote storage, encryption, retention, or third-party backup services.
• Vulnerabilities requiring unsupported Python versions or modified builds.