Security fixes are handled for the default branch and for the latest public release when releases are available.

Please do not report security vulnerabilities through public GitHub issues.

Use GitHub private vulnerability reporting for this repository if it is enabled. If private vulnerability reporting is not enabled, contact the Moore Threads maintainers through the official security channel published by the Moore Threads GitHub organization or project maintainers.

When reporting a vulnerability, include:

• Affected commit, tag, or wheel version.
• A concise description of the issue and impact.
• Reproduction steps, proof of concept, or crash logs when available.
• Whether the issue requires local access, model input control, or untrusted binary/package installation.

Maintainers will acknowledge valid private reports and coordinate disclosure timing before public details are published.