Apache TinkerPop's threat model — the assumptions, trust boundaries, what is in and out of scope, the security properties the project does and does not provide, and known non-findings — is documented in THREAT_MODEL.md. Please read it before reporting a security issue.
Please report security vulnerabilities privately following the ASF security process — email security@apache.org. Do not open public GitHub issues for security reports.