This is the default policy for Heretek-AI repositories. A repository's own SECURITY.md overrides it and may add scope and timelines.

Report privately, not in a public issue.

1. On the affected repository, open the Security tab and choose Report a vulnerability.
2. If that option is absent, open an issue titled "Security contact request" with no technical detail. A maintainer will open a private advisory and invite you.

Include the affected repository, the commit or version, reproduction steps or a proof of concept, and the impact you expect.

A maintainer acknowledges the report and keeps the advisory private until a fix ships. Reporters are credited unless they ask to stay anonymous.

Test against your own deployment, never against infrastructure you do not own.