# Security policy

We take security issues seriously and appreciate responsible disclosure.

## Reporting a vulnerability

Please **do not** open a public GitHub issue for security reports.

Instead, report privately by email:

- `contact@abstractcore.ai`

Include as much of the following as you can:

- A clear description of the issue and its impact
- Reproduction steps (or a minimal PoC)
- Affected versions / commit hash (if known)
- Any relevant logs, stack traces, or configuration
- Suggested mitigation (if you have one)

If you believe the issue is in an upstream dependency (e.g. Torch/Diffusers), it can still be helpful to notify us so we can assess impact and coordinate messaging for AbstractVision users.

## What to expect

We aim to:

- Acknowledge receipt within **3 business days**
- Provide a status update within **7 business days**

If a coordinated disclosure timeline is needed, please include your preferred timeline in the report.

## Scope

This policy applies to vulnerabilities in this repository’s code and packaging.

For non-security bugs and feature requests, please use the normal issue tracker.
