bayes-hdc is in alpha. Only the latest commit on main and the most recent tagged release receive security fixes.

Please do not open a public GitHub issue for security reports.

Use the GitHub Private Vulnerability Reporting channel: https://github.com/rlogger/bayes-hdc/security/advisories/new. Open a draft advisory; the report is private to the maintainers until disclosure. This is preferred over any email channel because it keeps the disclosure thread on GitHub and links the eventual patch to the advisory automatically.

Please include:

• A description of the issue and the conditions that trigger it.
• A minimal reproduction (Python snippet is ideal).
• The version or commit SHA you observed it on.
• The JAX / jaxlib versions, platform, and accelerator.
• Any suggested fix or mitigation.

• Acknowledgement within 72 hours.
• Initial assessment within 7 days.
• Patch or mitigation coordinated with the reporter; released as a new tag with a corresponding GitHub Security Advisory.

In scope:

• Code execution, sandbox escape, or privilege escalation in bayes_hdc/.
• Numerical correctness bugs that silently produce wrong hypervectors in published operations (these are prioritised as security issues when they affect capacity or retrieval guarantees).
• Vulnerabilities in the release / packaging pipeline.

Out of scope:

• Bugs in third-party dependencies (report those upstream).
• Performance regressions.
• Non-security bugs — please file a regular issue instead.