# Security Policy

## Reporting a vulnerability

Please report suspected vulnerabilities through GitHub's private security-advisory flow:

https://github.com/deltawi/deltallm/security/advisories/new

Do not disclose exploit details, secrets, customer data, or an unpatched vulnerability in a public
issue or discussion.

If private reporting is unavailable, open a minimal public issue asking the maintainers for a
private contact channel. Include no vulnerability details in that issue.

Include the affected version or commit, deployment shape, reproduction prerequisites and steps,
impact, sanitized evidence, and any known workaround. Maintainers will use the private channel to
acknowledge, reproduce, triage, coordinate remediation, and plan disclosure. No fixed response-time
SLA is currently published.

Deployment hardening and trust-boundary guidance is published at
https://docs.deltallm.io/security/.

## Verifying releases

Release images are signed with keyless cosign and carry an SBOM and SLSA build provenance. The
Helm chart package has a GitHub build provenance attestation. See
[How DeltaLLM releases are built and verified](docs/security/release-verification.md)
(https://docs.deltallm.io/security/release-verification/) for the verify commands.