Please do not open a public GitHub issue for security vulnerabilities.

Report security issues via a GitHub private security advisory — click "Report a vulnerability" on the Security tab of this repository. Include a description of the issue, steps to reproduce, and the potential impact. You will receive an acknowledgement within 48 hours.

Alternatively, you can reach the maintainers by email at security@humangr.com.

We follow responsible disclosure: we ask that you give us reasonable time to investigate and ship a fix before public disclosure.

This policy covers the hugit engine, CLI, and HTTP API. Vulnerabilities in third-party dependencies should be reported to the respective upstream projects.