AiExponent is committed to ensuring the security, integrity, and regulatory robustness of our open-source AI compliance tooling suite.

We actively maintain and provide security patches for the latest release branch of each organization tool:

Please do NOT open public GitHub issues or discussions for security vulnerabilities.

If you discover a potential security flaw, vulnerability, or sensitive data leakage, report it privately to our security engineering team:

📧 Email: security@aiexponent.com

To help us triage and resolve the issue quickly, please provide:

1. Tool & Version: The affected tool name, repository, and version/commit hash.
2. Vulnerability Type: e.g., prompt injection, SSRF, dependency vulnerability, command injection, path traversal.
3. Reproduction Steps: Step-by-step instructions or minimal proof-of-concept (PoC) code.
4. Impact Assessment: Description of potential attack vectors, exploitability, and affected data/systems.
5. Remediation Suggestion: If you have identified a potential patch or mitigation.

• Initial Acknowledgment: Within 48 hours.
• Triage & Preliminary Assessment: Within 5 business days.
• Coordinated Disclosure: We aim to release security patches within 30 days of triage confirmation.

We believe in responsible, coordinated vulnerability disclosure. If you make a good faith effort to comply with this policy during your security research:

• We will not pursue legal action against you.
• We ask that you give us reasonable time to patch the issue before public disclosure.
• Do not exploit the vulnerability beyond what is necessary to demonstrate it.
• Do not access, modify, or destroy any other user's or customer's data.

Unless you prefer to remain anonymous, we will gladly acknowledge and credit your contribution in the corresponding GitHub Security Advisory and release notes.