Please report suspected vulnerabilities through GitHub's private security-advisory flow:

https://github.com/deltawi/deltallm/security/advisories/new

Do not disclose exploit details, secrets, customer data, or an unpatched vulnerability in a public issue or discussion.

If private reporting is unavailable, open a minimal public issue asking the maintainers for a private contact channel. Include no vulnerability details in that issue.

Include the affected version or commit, deployment shape, reproduction prerequisites and steps, impact, sanitized evidence, and any known workaround. Maintainers will use the private channel to acknowledge, reproduce, triage, coordinate remediation, and plan disclosure. No fixed response-time SLA is currently published.

Deployment hardening and trust-boundary guidance is published at https://docs.deltallm.io/security/.