Please do not disclose suspected vulnerabilities through public GitHub issues, pull requests, discussions, or social media.

First, check the affected repository for a repository-specific SECURITY.md; its instructions take precedence. If the repository does not provide a dedicated process, submit a private report through techtideai.io and include "Security Report" and the affected repository or service in the subject or opening line. Do not include exploit details in public follow-up discussions.

A useful report identifies the affected repository, package, version, deployment, or service; describes the impact; provides concise reproduction steps or a proof of concept where safe to do so; and includes any proposed mitigation or relevant logs. Please provide a way to contact you for clarification and coordinated follow-up.

Maintainers will review reports in good faith, validate the affected scope, prioritize remediation based on impact and exploitability, and coordinate disclosure when appropriate. We may request additional information to reproduce or assess a finding. Do not assume a public issue, release note, or advisory until maintainers have confirmed that disclosure is appropriate.

This policy covers vulnerabilities in publicly maintained TechTide AI repositories and associated public services. Product defects, feature requests, documentation corrections, and configuration questions should use the support paths in SUPPORT.md instead.

We appreciate good-faith reports that help protect users and contributors. This policy does not grant permission to access, modify, or disrupt systems, data, or accounts outside the access you are explicitly authorized to use.