During the v0.x phase, only the latest tagged minor release receives security fixes.

Do not open a public Issue for a vulnerability involving secret exposure, arbitrary file access, ZIP extraction, SSRF, provider-key handling, cross-workspace data access, paid-request duplication, or authentication assumptions.

Use GitHub's private vulnerability reporting feature for the repository. If it is unavailable, contact the maintainer through the private address listed in the GitHub profile and include:

• affected version or commit;
• minimal reproduction with synthetic data;
• impact and attacker prerequisites;
• whether provider cost or private data may be affected;
• suggested mitigation, if known.

Do not include real API keys, customer images, customer prompts, or complete private model responses. The maintainer will acknowledge a valid report as soon as practical, coordinate a fix and disclosure date, and credit the reporter unless anonymity is requested.

VLMForge v0.1 is a local single-workspace tool with no login. It must not be exposed directly to the public internet. Docker Compose credentials in .env are host-managed environment variables, not Docker Secrets; protect the file and host accordingly.

Expected controls include:

• bounded ZIP extraction and path containment;
• safe JSONLogic instead of arbitrary code;
• environment-only Provider keys;
• no images, complete prompts, tokens, or complete responses in SSE/logs;
• uncertain instead of automatic retry after ambiguous paid dispatch;
• real PostgreSQL, Redis, and MinIO readiness checks.

Security reports that rely on deliberately publishing this unauthenticated local tool to the internet may be closed as out of scope, but defense-in-depth improvements are welcome.