Open Intelligence Labs takes the security of our software seriously. This policy applies to every project in the openintelligence-labs organization unless that project ships its own SECURITY.md overriding it.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately via one of:

1. GitHub Security Advisories (preferred): open a private vulnerability report on the affected repo, or on this .github repo if unsure which is affected. This gives us a private channel and a place to coordinate a fix.
2. Email: security@openintelligence-labs.dev (set up before any public launch).

Please include:

• The project and version affected
• A description of the vulnerability and its impact
• Reproducible steps or proof-of-concept
• Your suggested mitigation, if any
• Whether you'd like public credit (and how to credit you)

• Acknowledgement within 3 business days.
• Initial assessment within 7 days (severity, reproduction confirmed, scope).
• Fix timeline depends on severity — critical issues prioritized within days; lower-severity within the next minor release.
• Coordinated disclosure: we will agree on a public-disclosure date with you. Default embargo is up to 90 days from initial report, in line with industry norms (Google Project Zero, GitHub coordinated disclosure).
• Credit: contributors who report responsibly are credited in the security advisory and release notes (unless you ask not to be).

In scope:

• Vulnerabilities in the source code of any repo under openintelligence-labs
• Vulnerabilities in our published packages (PyPI, npm, crates.io, Docker images, Homebrew taps)
• Dependency vulnerabilities we should patch by upgrading

Out of scope:

• Vulnerabilities in third-party LLM providers or APIs
• Issues in user-supplied configurations (e.g., exposing your own Ollama server publicly)
• Self-XSS in development tooling
• Theoretical attacks without a concrete impact path
• Volumetric / DoS issues against demo or example servers

We will not pursue legal action against researchers who:

• Make a good-faith effort to comply with this policy
• Avoid privacy violations, destruction of data, and disruption of others' services
• Give us a reasonable opportunity to fix before public disclosure

Once a fix is released, we publish:

• A GitHub Security Advisory on the affected repo
• A CVE if the issue qualifies (we are a CNA-eligible organization)
• A note in the affected project's CHANGELOG

Researchers credited in our advisories will be listed in this section once the first one is published. We do not run a paid bug bounty program; we do offer credit, swag (when available), and our genuine thanks.

Questions about this policy? Open a discussion on this repo or email security@openintelligence-labs.dev.