RxJS currently has one active maintainer. The same maintainer may author, review, merge, and release a change. The project does not claim independent human review; release safety relies on mandatory automation, reproducible artifacts, narrow credentials, separate GitHub/npm authorization, and public verification evidence.

When RxJS 9 becomes stable, its latest release becomes the supported production line. Any future change to RxJS 7 support will be announced separately; this policy does not invent a sunset date.

Do not open a public issue for a suspected vulnerability. Use a private GitHub security advisory and include the affected version, impact, reproduction, and any known workaround.

The maintainer targets:

• acknowledgment within five business days;
• an initial assessment within ten business days;
• case-specific remediation and coordinated-disclosure timing after assessment.

These are response targets, not guaranteed fix deadlines. If investigation or coordination takes longer, the reporter will receive an update explaining the delay and the next expected checkpoint.

See RxJS 9 security assurance for release controls, verification commands, limitations, and the current supply-chain evidence model.