EvalMesh takes security vulnerabilities very seriously. We actively release patches for all minor and major releases.

If you discover a potential security vulnerability within EvalMesh, please do not open a public issue.

Instead, report vulnerabilities directly to our core security team:

• Email: security@evalmesh.io
• GPG Key: Available upon request for encrypted communications.

1. Description: Clear explanation of the vulnerability and its potential impact.
2. Reproduction Steps: Step-by-step instructions or PoC payload.
3. Environment: EvalMesh version, Python version, and operating system details.

• Initial Acknowledgment: Within 24 hours.
• Triage & Severity Assessment: Within 48 hours.
• Patch Release: Within 7 business days for high-severity vulnerabilities.

Thank you for helping keep EvalMesh and the open-source AI community secure!