If you discover a security vulnerability in TorchWM, please report it privately by opening a security advisory on GitHub:

https://github.com/paramthakkar123/torchwm/security/advisories/new

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

• A clear description of the vulnerability
• Steps to reproduce (if applicable)
• Affected versions
• Any potential mitigations you have identified

• Acknowledgment: within 48 hours
• Initial assessment: within 5 business days
• Fix and release: timeline depends on severity, typically 7–30 days

Every torch.load in TorchWM, including the torchwm eval / torchwm play entry points, the scripts in scripts/ and the demos in demos/, passes weights_only=True, and subprocesses run with subprocess.run(shell=False). Only open checkpoints from sources you trust all the same. If you find any code path that deviates from these patterns, please report it.