Meta has a bug bounty program for the safe disclosure of security bugs. Please report security issues through that program and do not open a public issue. A public issue must never contain sensitive inputs, model output, media, encoded masks, credentials, or reproduction data.

Use synthetic media and synthetic SAM 3 output in tests and reports. The packages do not transmit telemetry or credentials. Applications remain responsible for securing Responses API traffic, media sources, logs, and rendered output.