Report vulnerabilities privately through GitHub's private vulnerability reporting form. If private reporting is unavailable, open an issue requesting a private contact without posting exploit details, credentials, or sensitive data.

Include the affected version, configuration, expected boundary, reproduction steps using harmless sentinel tools, and observed result. Please avoid testing against services or data you do not own.

System 1 1.x has a stable core. Fixes target the latest release; older versions are not maintained as separate branches. Report failures in deterministic policy enforcement, signed receipt verification, ledger integrity, model loading, or integration dispatch.

The statistical classifier is not a general-purpose security detector. The application supplies authenticated identity, isolates tools, protects policy and signing keys, and enforces returned decisions. Read deployment boundaries before using the library for consequential actions.