If you discover a security vulnerability in Thulium, please report it responsibly.

1. Do not open a public issue
2. Email security concerns to: security@thulium-dev.io
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: Next release

• We follow responsible disclosure practices
• Reporters will be credited (unless anonymity requested)
• CVE will be requested for confirmed vulnerabilities

When using Thulium:

1. Validate inputs — Don't process untrusted images without validation
2. Use latest version — Security fixes are only in supported versions
3. Verify model integrity — Check model hashes when downloading
4. Sandbox execution — Run untrusted workloads in containers