Report suspected vulnerabilities affecting repository code, distributed packages, or official model artifacts confidentially by email to trust@nums.world.

Include the affected repository, component and version or commit, relevant environment, minimal reproduction steps, and expected impact. An incomplete report can still be useful.

Use synthetic or redacted evidence. Share exploit details privately during investigation and remediation, and coordinate public disclosure as described below. Keep credentials, personal information, and customer data out of public Issues, pull requests, and Discussions. Agree on a secure way to share sensitive material when needed.

Maintainers and reporters should coordinate investigation, remediation, and the timing and content of public disclosure. Public advisories should omit confidential evidence and unnecessary personal information.

For ordinary bugs, use the affected repository's Issues. Ask usage questions in Discussions when enabled, otherwise Issues. For conduct concerns, see CODE_OF_CONDUCT.md.

We aim to acknowledge and assess reports and provide updates as appropriate. Response and remediation times vary; no fixed deadline is guaranteed. Rewards or a bug bounty are offered only if separately announced.