DCA Inference Engine is a research project. It is not yet hardened for production deployment.

Please use GitHub private vulnerability reporting if it is enabled on the repository. If not, open a minimal public issue that says a vulnerability exists without publishing exploit details, and the maintainers will arrange a private channel.

Please include:

• affected commit or release,
• operating system and compiler,
• model file source if relevant,
• steps to reproduce,
• expected impact,
• suggested fix if known.

• Treat GGUF model files as untrusted binary input unless the source is known.
• Parser and tensor-size validation should fail closed on unsupported metadata, dtypes and shapes.
• Long contexts can consume large amounts of memory.
• Timing and memory-access patterns are not currently side-channel hardened.
• Integer overflow behavior must be deliberate: wrap, saturate or fail fast, but never accidental undefined behavior.

Production use requires additional review around binary parsing, memory limits, sandboxing, supply-chain integrity and side-channel behavior.