AI_Engineering_Cockpit handles API keys, model outputs, and (depending on how you configure it) potentially sensitive data flowing through the security, governance, and compliance frameworks. We take security issues seriously and appreciate responsible disclosure.

This project is pre-1.0 and evolving rapidly. Security fixes are applied to the main branch only.

Please do not open a public GitHub issue for security vulnerabilities.

Report it privately using either channel:

1. Preferred: GitHub Security Advisories for this repository. Private, notifies the maintainer directly, and gives us a place to coordinate a fix and disclosure with you.
2. Email: sumon-2930@outlook.com

Use the advisory channel where you can — it keeps the report, the fix, and the disclosure timeline in one place. Email is there for when you would rather not open a GitHub account, or the issue concerns the repository itself.

When reporting, please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof-of-concept code or commands, if possible)
• The affected file(s)/module(s) (e.g. cockpit/security/input_security.py)
• Any suggested mitigation, if you have one

• Acknowledgment: within 3 business days
• Initial assessment: within 7 business days, including severity and next steps
• Fix & disclosure: we aim to ship a fix and coordinate disclosure within 90 days of the report, sooner for critical issues. We will credit you in the fix's release notes unless you prefer to remain anonymous.

In scope:

• The cockpit/ core framework (testing, evaluation, red teaming, security, monitoring, governance modules)
• Example projects under projects/
• CI/CD workflows under .github/workflows/
• Setup and tooling scripts under scripts/

Out of scope:

• Vulnerabilities in third-party dependencies (please report those upstream; we welcome a heads-up so we can pin/patch, but the primary fix belongs with the upstream project)
• Issues that require an already-compromised machine or .env file
• Social engineering or physical security

If you find a hardcoded credential, API key, or secret committed to this repository (including in git history), report it the same way — treat it as a security vulnerability, not a bug. Do not open a public issue that references the specific commit or file until it has been rotated/removed.

We follow coordinated disclosure: please give us a reasonable window to investigate and ship a fix before any public disclosure. We will keep you updated throughout the process.