Do not report a vulnerability in a public issue or pull request. GitHub private vulnerability reporting is enabled for this repository. Open the repository's Security tab, choose Report a vulnerability, and submit the report there:

https://github.com/cortexkit/synapse/security/advisories/new

Include the affected release or full source commit, platform, reproduction steps, expected security boundary, and observed impact. Provide the smallest safe reproducer; do not include credentials, private model data or unrelated user content. If sensitive evidence is needed, describe it first rather than publishing it in a public discussion.

Reports about model/artifact integrity, worker isolation, IPC authentication, remote credential handling, durable-state authority or dependency vulnerabilities are welcome. Identify the actual Synapse version and configuration so maintainers can assess applicability. This policy does not promise support for every historical version or a fixed response timeline.

Coordinate publication through the private advisory discussion. Ordinary bugs without a security impact follow CONTRIBUTING.md.