If you believe you have found a security vulnerability in z4j-huey, do not open a public GitHub issue. Email security@z4j.com instead.

We acknowledge reports within 48 hours, provide a preliminary assessment within 5 business days, and target fixes within 30 days (7 days for confirmed critical issues). Reporting timelines, safe harbor, supported-version policy, and published advisories are maintained in the canonical z4j project security policy.

This adapter runs inside Huey consumers with their storage access. An authenticated brain can submit, retry with replacement inputs, and revoke pending tasks (Huey revoke_by_id, which cannot stop running work) through the advertised controls. Registry lookup, argument validation, enqueue calls, result probing, and Huey signal mapping are package-specific security surfaces; transport, redaction, and authorization policy remain owned by z4j-core and the brain.