If you believe you have found a security vulnerability in VibeLang, please do not open a public GitHub issue.

• Why private? Public issues can unintentionally disclose exploitation details before a fix is available. Private reporting lets maintainers triage, patch, and coordinate disclosure safely.

• Report privately: email sami.ahmadkhan12@gmail.com with details and a minimal reproduction.

• Alternative: use GitHub’s private vulnerability reporting (Security Advisories) if enabled for the repository.

• Include: affected versions, impact, steps to reproduce, and any suggested mitigations.

We will acknowledge receipt and begin triage as soon as possible.

VibeLang follows coordinated disclosure and a structured CVE response workflow:

• Disclosure policy: docs/security/disclosure_policy.md
• CVE response workflow: docs/security/cve_response_workflow.md

Security fixes are released for supported versions according to the project’s release policies.