MetaVeins is a privacy/security-adjacent project. If you find a security issue, please report it responsibly.

• Preferred: use GitHub Security Advisories on this repository (Security tab → "Report a vulnerability") once the repo is live, so the report stays private until a fix is ready.
• If GitHub Security Advisories isn't available/enabled yet: open a regular issue with minimal detail and a note asking a maintainer to reach out for a private channel — do not post exploit details in a public issue.
• (A dedicated security-contact email is not yet established — this will be added here once set up. Do not assume any specific address until it appears in this file.)

• Affected version/commit.
• Steps to reproduce.
• Impact assessment (what data/behavior is affected).
• Suggested severity, if you have an opinion.

• No real private media or real personal metadata — use synthetic data to demonstrate the issue, consistent with the project's fixture rules (see CONTRIBUTING.md, TEST_STRATEGY.md).
• No mass-disclosure or public exploit details before a fix is available.

1. Acknowledge the report.
2. Confirm/reproduce.
3. Develop and test a fix, following the same SECURITY_TESTING.md rigor as any other change.
4. Release a patched version per RELEASE_STRATEGY.md's security-sensitive release process.
5. Publicly credit the reporter (if they want credit) once the fix is out.

Security-relevant issues (parser crashes on adversarial input, crypto flaws, leakage in logs/temp files) are prioritized above feature work, and any fix gets a permanent regression test per TEST_STRATEGY.md — this project treats "no regression test for a fixed security bug" as an incomplete fix.