Please report security issues privately through GitHub's security advisory process rather than a public issue:

https://github.com/dansupergameprogrammer/SuperEmbedder/security/advisories/new

This opens a private advisory visible to the maintainers and the reporter. Please do not open a public issue for a suspected vulnerability.

Enough to reproduce: the affected version or commit, the platform and toolchain, and the smallest input or call sequence that demonstrates the problem. For a memory-safety or validation issue in a file SuperEmbedder reads — a bank's .wvbank.json, .wvbank.bin or .semb.json, a corpus, or the model and tokenizer artifacts, which pass through the SuperSLM loader — a minimal file that triggers it is the most useful attachment.

This covers the SuperEmbedder library, its C header, and the semb command line tool in this repository. Issues in the SuperSLM engine's loader or forward belong to SuperSLM, and issues in bank search belong to SuperFAISS; if you are unsure which project owns a problem, report it here.

A bank bundle whose manifest, rows and digests were edited together so that they agree with each other is not a vulnerability: SuperEmbedder detects accidental and stale mismatch, not forgery, and says so in docs/DETERMINISM.md. A crash, out-of-bounds read, or wrong vector returned with SEMB_OK while reading such a bundle is.

This is a single-maintainer project. There is no fixed SLA, but reports are read and acknowledged as soon as practical, and a fix or mitigation is prioritized once a report is confirmed.