Thank you for helping keep Machine Learning Projects and its users safe.
This repository has no versioned releases. Only the current main branch is
supported; security fixes are applied there.
Please do not open a public issue for security problems.
Report privately through GitHub's private vulnerability reporting:
- Open https://github.com/vitorparras/Machine-Learning-Projects/security/advisories/new.
- Describe the problem, where it is, how to reproduce it and the impact you expect. A proof of concept is welcome but not required.
If you cannot use GitHub, e-mail contato.vitorparras@gmail.com with the same
information. Put [SECURITY] Machine-Learning-Projects in the subject.
| Step | Target |
|---|---|
| Acknowledgement of your report | within 3 business days |
| Initial assessment and severity | within 7 days |
| Fix or mitigation for confirmed issues | within 90 days, sooner for critical issues |
| Public disclosure | coordinated with you after the fix is available |
You will be credited in the advisory unless you prefer to stay anonymous.
In scope:
- Content in this repository that would lead a reader to an insecure practice (for example, an example that is vulnerable by construction without saying so).
- Code, scripts, configuration and GitHub Actions workflows in this repository.
- Supply-chain issues: dependencies, pinned actions, build and release process.
Out of scope:
- Vulnerabilities in third-party tools or services that are only referenced here.
- Issues that require physical access to a maintainer's machine or account.
Good-faith research that follows this policy is authorized. We will not pursue legal action against researchers who avoid privacy violations, data destruction and service disruption, and who give us reasonable time to fix the issue before disclosing it.
mainonly receives changes through pull requests; force pushes and branch deletion are blocked.- Secret scanning with push protection, Dependabot alerts and security updates, and private vulnerability reporting are enabled.
- GitHub Actions are restricted to GitHub-owned and verified creators, pinned by commit SHA, with read-only default permissions.
- OpenSSF Scorecard runs weekly and publishes results.