This repository is in active pre-v0.1.0 development. Treat all APIs as unstable until a v0.1.0 tag is cut.

If you discover a security vulnerability in tpt-engineering or any of its tpt-eng-* crates:

1. Do not open a public GitHub issue.
2. Report it privately to TPT Solutions security contact (security at tpt-solutions — internal routing) or, if unavailable, via GitHub's private vulnerability reporting on the repository.
3. Include:
   • Affected crate(s) and version/commit,
   • A minimal reproduction,
   • The impact and any known mitigations.

We aim to acknowledge reports within 5 business days and to provide a remediation plan within 30 days, depending on severity.

• unsafe_code is forbidden workspace-wide ([workspace.lints.rust] unsafe_code = "forbid").
• Developer tooling (xtask) is dependency-free pure std, adding no third-party supply-chain surface to the engineering crates.
• cargo-deny (advisories/licences/bans/sources) and cargo-audit run in CI; unknown registries/git sources and yanked certificates are rejected.
• Cargo.lock is committed so builds are reproducible.