If you discover a security vulnerability in this project, please report it by opening an issue with the label security.

Do not open a public issue for security vulnerabilities. Instead, contact the maintainers directly.

When reporting a security issue, please include:

1. A description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact
4. Any suggested fixes (if applicable)

We aim to respond to security reports within 48 hours.

This policy applies to all code in this repository, including:

• Python code examples
• Web API examples (FastAPI, Flask)
• LLM training and inference code

Out of scope:

• Dependencies (report to upstream maintainers)
• Development tools and configuration files

We appreciate responsible disclosure and will acknowledge contributors who report valid security issues (unless they prefer to remain anonymous).