xVRAM has not released a supported production version. Security fixes currently target the default branch.

While the repository is private, collaborators should create a private repository security advisory or contact the owner through an existing private channel instead of opening an issue. GitHub private vulnerability reporting must be enabled before the repository is made public so external researchers have a safe disclosure path.

Include the affected revision, environment, reproduction steps, impact, and whether GPU device loss or host memory corruption is involved.

Do not attach reports containing secrets or unrelated machine identifiers. Capability reports include hardware and operating-system metadata and should be reviewed before public sharing.