Security fixes apply to the default branch and, when appropriate, to the latest published release. Earlier research releases remain available for provenance and may not receive patches.

Do not open a public issue for a suspected vulnerability or an accidentally published secret.

Use GitHub's Report a vulnerability function in the repository Security tab. Include the affected commit or release, reproduction steps, impact, and any suggested mitigation. Please avoid including unrelated personal, production, or confidential data.

The project is an experimental benchmark and is not presented as production infrastructure. Nevertheless, reports affecting its runner, Docker configuration, dependency handling, generated artifacts, or contributors are welcome.

You can expect an acknowledgement within seven days. Disclosure and remediation timing will be coordinated according to severity and the risk to users.