Please do not report security vulnerabilities in public issues, discussions, or pull requests.
- Preferred: use GitHub's private vulnerability reporting via the Security tab of the affected repository ("Report a vulnerability"), where it is enabled.
- Otherwise: email blanket@activeinference.institute with the subject line
[SECURITY] <repository name>.
Include the affected repository, a description of the issue and its impact, and steps to reproduce if possible.
The Active Inference Institute is a volunteer-led nonprofit. We will acknowledge your report as soon as we can, keep you informed as we investigate, and credit you when a fix is published unless you prefer to stay anonymous.
This policy covers repositories in the ActiveInferenceInstitute organization. Many are research and educational code and are not intended for production use; see each repository's README for its status.