Report sensitive findings using this repository's private vulnerability reporting channel when enabled. Do not post credentials, private checkpoints or exploit details in a public issue.

The repository contact is listed in configs/release/publication.json. Use the public Issues page only to request a private contact route if the repository's private reporting channel is unavailable.

HF remote-code loading executes model-provided Python. Use the reviewed source and a fixed model revision; keep private credentials and data outside model directories. The targeted source scanner complements, but does not replace, a full credential and license review.