Security fixes are considered for the latest Tianwen research preview on the default branch. Earlier commits and experimental branches are not supported release lines. This project does not currently provide a production SLA.

Do not post vulnerability details, proof-of-concept code, credentials, private repository content, user data, or sensitive logs in a public issue.

Use GitHub's private vulnerability report for this repository:

1. Open the repository's Security Advisories page.
2. Select Report a vulnerability.
3. Describe the affected component and revision, impact, minimal reproduction, and any suggested mitigation. Redact all credentials and personal data.

If GitHub does not show the private reporting form, do not publish the security details. Open a details-free issue asking the maintainers to provide or enable a private reporting path, then wait for that path before sharing sensitive information.

Maintainers will triage reports on a best-effort basis, coordinate a fix when the issue is in scope, and agree on disclosure timing with the reporter. No response or remediation time is guaranteed for this research preview.

For ordinary development questions, use the public guidance in CONTRIBUTING.md. The current architecture and trust boundary are documented in the architecture overview.