# Security Policy

If you discover a security vulnerability, suspected infringement, or another compliance concern in this repository, please report it privately to `octobus-opensource@chaitin.com`.

Please include the following details where possible:

- Repository URL and relevant branch, tag, commit, or pull request
- Affected files, components, or features
- A clear description of the issue
- Reproduction steps, logs, screenshots, or supporting evidence
- Any proposed mitigation or urgency assessment

We typically respond to new reports within 3 business days and will review them as quickly as possible.

Please do not disclose unpatched vulnerabilities or sensitive compliance concerns publicly before we have had a chance to investigate and respond.

If you are unsure whether an issue should be reported here, contact `octobus-opensource@chaitin.com` first and we will route it internally.