If you believe you have found a security vulnerability in z4j-taskiqscheduler, do not open a public GitHub issue. Email security@z4j.com instead.

We acknowledge reports within 48 hours, provide a preliminary assessment within 5 business days, and target fixes within 30 days (7 days for confirmed critical issues). Reporting timelines, safe harbor, supported-version policy, and published advisories are maintained in the canonical z4j project security policy.

This adapter inventories the configured TaskIQ schedule source. Schedule metadata projection and delegation to a custom source are package-specific security surfaces; transport, redaction, and authorization policy remain owned by z4j-core and the brain. The standard label source is read-only, so the adapter does not advertise schedule deletion.