# Security Policy

## Scope

BatteryMHM is a research library for harmonic-feature modeling. It does not
handle credentials, network services, or user data, so its attack surface is
small. Still, we take correctness and supply-chain integrity seriously.

## Supported versions

The latest released version (`1.0.0`) is supported.

## Reporting a vulnerability

If you discover a security issue (for example, a dependency vulnerability, a
deserialization risk in user-supplied data, or a way the library could be made
to execute untrusted code), please **do not open a public issue**. Instead,
report it privately via the Hugging Face model discussion page (mark it as a
security concern) or the repository's private advisory channel.

Please include:

- A description of the issue and its impact
- Steps to reproduce
- Affected version(s) and environment

We aim to acknowledge reports within a few business days and to address
confirmed issues promptly.

## Note on model weights

This repository distributes **no** trained model weights or pickled objects.
If you train your own models, never `pickle.load` weights from an untrusted
source — pickle can execute arbitrary code on load.