AxiomNode Lab takes vulnerability reports seriously. Repository-specific SECURITY.md files override this default policy when present.

Please avoid publishing a working exploit or sensitive details in a public issue before maintainers have had a reasonable opportunity to assess the report.

Use the repository's private vulnerability reporting feature when it is enabled. If private reporting is unavailable, contact a maintainer through an appropriate private channel listed by that repository or organization profile.

A useful report includes the affected repository/version, security impact, prerequisites, minimal reproduction steps, and any relevant environment details. Remove credentials, personal data, and unrelated confidential information.

We prioritize issues that affect confidentiality, integrity, authorization, code execution, secret handling, supply-chain integrity, or meaningful security boundaries. Feature requests, theoretical issues without a plausible impact, and unsupported deployment assumptions may be handled through the normal issue tracker instead.

We do not claim a security property has been verified until it is supported by tests, review, or other evidence appropriate to the project.