安全修复优先进入当前 main 分支和最新公开发布；旧快照、个人分支和第三方 fork 不承诺维护，也不提供固定响应 SLA。
请优先在仓库 Security 页面使用私密漏洞报告（如可用）。否则请通过维护者的 GitHub 主页请求私下联系；可以创建不含漏洞细节的最小公开 Issue，请求安全联系渠道。
报告应包含受影响版本或提交、最小复现步骤、实际与预期行为、影响范围、利用前提和缓解建议。获得维护者确认前，不要公开可利用细节、真实数据、凭据或恶意载荷，也不要测试未经授权的系统。
- 本地 HTTP 服务默认只用于 loopback，不应直接暴露到公网。
- Detector 不执行用户输入的 Shell，也不能把 candidates 自动提升为 annotation。
- 文件导入、导出与数据根目录必须防止路径逃逸、任意覆盖和数据泄露。
- 本仓库不分发模型权重；不要通过 Issue、PR 或 Release 附件绕过该边界。
- CloudBase 和其他云服务当前未接入，任何未来凭据不得进入仓库、前端或日志。
Security fixes target the current main branch and latest public release. Old snapshots, personal branches, and third-party forks are not maintained, and no fixed response SLA is promised.
Prefer private vulnerability reporting from the repository's Security page when available. Otherwise, use a maintainer's GitHub profile to request a private channel. A minimal public issue may request security contact information but must contain no vulnerability details.
Include the affected version or commit, minimal reproduction, actual and expected behavior, impact, prerequisites, and mitigations. Do not publish exploitable details, real data, credentials, or malicious payloads before maintainers acknowledge the report, and do not test systems without authorization.
- The local HTTP service is loopback-oriented and should not be exposed directly to the public internet.
- The detector does not execute user-provided shell text and cannot promote candidates to annotations automatically.
- File import, export, and dataset-root handling must prevent path escape, arbitrary overwrite, and disclosure.
- This repository does not distribute model weights; do not bypass that boundary through issues, pull requests, or release attachments.
- CloudBase and other cloud services are not integrated; future credentials must never enter the repository, frontend, or logs.