Please report a suspected vulnerability privately to contact@smithlabs.ai with "SmithGuard security report" in the subject. If the repository's Security tab offers "Report a vulnerability", that private channel is also suitable. Do not use a public issue or pull request for an unpatched vulnerability.

Include the affected commit/version, a concise impact description and the smallest safe reproduction you can provide. Omit live credentials, private dependency lists and unrelated personal data. Coordinate disclosure with maintainers while a report is assessed. Responses are best effort; no guaranteed response time or bounty is offered.

Security fixes target the current main branch and hosted service. Older source revisions do not have a separate long-term support commitment. An upstream advisory shown by SmithGuard is different from a vulnerability in SmithGuard itself.

Use local synthetic test environments. This policy does not authorize testing against the hosted service, customer systems or any third-party publisher. Do not attempt denial of service, credential access or data extraction.