This policy applies to security vulnerabilities in any code, tooling, or specifications maintained in this repository.
It does not cover vulnerabilities in AI systems or third-party tools referenced in our documents — those should be reported directly to their respective maintainers.
Please do not report security vulnerabilities through public GitHub issues.
Email security@secureaialliance.org with:
- Description — a clear explanation of the vulnerability
- Impact — what could an attacker do?
- Reproduction steps — how to reproduce the issue
- Affected versions — which releases or commits are affected
- Mitigations — any known workarounds
| Milestone | Target |
|---|---|
| Acknowledge receipt | Within 72 hours |
| Confirm vulnerability | Within 7 days |
| Release fix / advisory | Within 90 days, coordinated with reporter |
| Public disclosure | After fix is available, coordinated with reporter |
We will keep you informed throughout the process and credit you in the advisory unless you prefer to remain anonymous.
We ask that you:
- Give us reasonable time to address the issue before public disclosure
- Avoid accessing or modifying data belonging to others
- Act in good faith
We commit to:
- Respond promptly and keep you updated
- Not pursue legal action against researchers acting in good faith
- Credit you publicly (if desired)