| Version | Supported |
|---|---|
0.0.x (main / master) |
✅ |
| Older tags | Best-effort |
Do not open a public GitHub issue for security-sensitive reports.
- Prefer GitHub Security Advisories on this repository.
- Or email the maintainers via the org contact listed on the open-video-ai profile once public.
Please include:
- Impact description
- Reproduction steps or PoC (non-destructive)
- Affected version / commit
- Whether you plan to disclose publicly and on what timeline
We aim to acknowledge within 72 hours and provide a remediation plan for confirmed issues.
- Model weights (MiniMax H3, etc.) are third-party; report weight/model license issues to the upstream provider when appropriate.
- ComfyUI is an external engine; report ComfyUI core vulns upstream when the issue is not in open-video’s adapter code.
- Generated content (CSAM, malware in prompts, etc.) is handled under community moderation and hoster ToS — not as a product CVE unless there is a clear product bug enabling abuse at scale.
- Never commit API keys, cloud tokens,
.env, or private GPU host paths with credentials. - Installer and CLI must not exfiltrate user prompts or videos to third parties without explicit opt-in.