This project follows a rolling-release model on the main branch. Only the latest commit on main is supported with security fixes.

If you discover a security vulnerability in PhysiLens, please do not open a public GitHub issue. Instead:

1. Open a private security advisory on this repository, or
2. Contact the maintainers through the repository's designated security contact channel (see repository settings).

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof-of-concept code, if available)
• Any suggested remediation

We aim to acknowledge reports within 5 business days.

Security-relevant areas of this project include:

• Image upload validation and handling (engine/main.py)
• Session management and data isolation (engine/main.py — SessionStore)
• CORS and HTTP security headers (engine/config.py, interface/next.config.mjs)
• Dependency supply-chain integrity (requirements.txt, package.json)

• Vulnerabilities in third-party dependencies should be reported upstream to the respective project, though we welcome a heads-up so we can update our pinned versions.
• The accuracy of AI model outputs (SAM, Depth-Anything-V2) is a model-quality concern, not a security issue, unless it results in a genuine security vulnerability (e.g., a crafted input causing a crash or resource exhaustion).