Report vulnerabilities in the affected repository using Security → Report a vulnerability, when private vulnerability reporting is enabled. The organization profile repository provides a private reporting form.

If a project's private reporting form is unavailable, contact the maintainer through Lei Wang's contact page. Include the affected version or commit, impact, and minimal reproduction steps. Share sensitive details only through the private channel.

Please avoid disclosing exploit details, credentials, or restricted data in public issues. Ordinary bugs and documentation errors belong in the project's issue tracker.

Each research software repository should state its own supported versions and security policy. This repository contains organization documentation, templates, and visual assets; corrections are applied to its current default branch.