Security fixes are made on the main branch of the canonical repository. The latest tagged release, when one exists, is supported until a newer release is published. Historical research snapshots and the personal mirror do not receive separate security fixes.

Please do not open a public issue for a suspected vulnerability, exposed credential, private-data disclosure, or other report that could place users or data at risk. Use GitHub's private vulnerability reporting form for the canonical repository:

https://github.com/HKUST-FintechLab/PsyAgent/security/advisories/new

If that form is unavailable, contact the canonical repository maintainer through the contact method on their GitHub profile and request a private channel. Do not send live credentials, private datasets, or unnecessary personal information in the initial message.

Include, when possible:

• the affected commit, file, and component;
• a minimal reproduction that does not expose real secrets or private data;
• the expected impact and prerequisite access;
• whether the issue is already public; and
• a safe way to contact you for follow-up.

The maintainers aim to acknowledge a complete report within seven days. A fix timeline depends on severity, reproducibility, upstream dependencies, and the availability of affected maintainers. Please allow coordinated remediation before public disclosure.

Security reports may include credential exposure, unsafe command execution, dependency or workflow compromise, unauthorized data access, and privacy leaks caused by repository code or configuration. Scientific limitations, model quality, psychometric validity, and ordinary feature requests belong in the issue tracker unless they also create a concrete security or privacy risk.

This research repository does not operate a bug-bounty program and makes no guarantee that experimental model-serving code is suitable for deployment. Review network exposure, authentication, logging, model licenses, and data handling before running any service component.