Please do not open a public issue for security problems.

Use GitHub's private vulnerability reporting: Security → Report a vulnerability on this repository (https://github.com/aimd54/palan/security/advisories/new).

You can expect an acknowledgement within 7 days. Reports are triaged, fixed privately, and disclosed via a GitHub Security Advisory once a patched release is available.

Pre-1.0, only the latest minor release line receives security fixes.

Every release whose changes fix a publicly known vulnerability names it in the release notes, with its CVE identifier where one has been assigned, so that reading the notes is enough to tell whether an upgrade carries a security fix. Vulnerabilities reported privately are disclosed the same way once a patched release exists, alongside the GitHub Security Advisory.

Releases that fix nothing security-relevant say nothing about it, so the absence of a note means no known vulnerability was addressed.

Model weights are attacker-controlled inputs: palan verifies blob digests on every transfer and supports cosign signature verification on pull (palan pull --verify, verify.required in the config). Weaknesses in those guarantees (digest bypass, signature confusion, path traversal during unpacking, or --insecure behavior beyond its documented warning) are all in scope and highly appreciated reports.