Only the latest release on the main branch is supported with security fixes.

Please report suspected vulnerabilities privately. Do not open a public issue.

1. Go to the repository's Security tab.
2. Click Report a vulnerability.
3. Describe the issue and submit the private report.

GitHub private vulnerability reporting keeps the report visible only to the maintainer until a fix is ready.

• A description of the issue and its impact.
• Steps to reproduce, or a proof of concept.
• The affected file(s), commit, or release.
• Any suggested fix or mitigation, if you have one.

This is a solo research project maintained on a best-effort basis. We will try to acknowledge reports and work on fixes as time allows. No response-time or fix-time guarantees are made.

In scope:

• Code in this repository.
• Training scripts.
• Released model weights.

Dependencies are monitored by Dependabot, and code is scanned by CodeQL on pushes and pull requests to main.