Email security@ingestron.io. Do not open a public issue. Include the version of @ingestron/pack-databricks, what you ran, and the smallest definitions that reproduce the problem. We acknowledge reports within five working days and agree a disclosure date with you.

Security fixes go into the latest 1.x release.

The pack turns a resolved model into files. It makes no network calls, runs no code from the definitions, and writes secrets only as references.

Dependencies are pinned exactly and updated one reviewed change at a time; pnpm validate checks their licences.