# Security policy

Do not open a public issue containing credentials, private memory data, or a
working exploit. Use GitHub's private vulnerability reporting for this
repository when available.

TMCRA checkpoints must be loaded with `torch.load(..., weights_only=True)` and
verified against the published SHA-256 manifest. The maintainers do not
support disabling these checks for untrusted checkpoints.

Provider API keys belong only in local `*.env` files. The example files contain
placeholders and real environment files are excluded by `.gitignore`.