This policy covers every cavi-ai repository that does not have its own SECURITY.md. A repository's own policy takes precedence.

Please do not open a public issue for security vulnerabilities.

Report privately:

1. Use Security → Report a vulnerability on the affected repository when that form is available.
2. Otherwise, email [email protected] with "Security" and the repository name in the subject.

Include:

• the affected repository and the version or commit,
• a description of the issue and its impact,
• steps to reproduce (a minimal proof of concept if possible),
• any suggested remediation.

You can expect an acknowledgement and an initial assessment. Please allow a reasonable window for a fix before any public disclosure.