Do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
Report them privately:
- GitHub private vulnerability reporting (preferred). On the affected repository, open the Security tab and choose Report a vulnerability. If the repository does not show that option, use email.
- Email: security@coralmind.org.
Include what you can: the type of issue, the repository and version or commit, steps to reproduce, a proof of concept if you have one, and the impact you believe it has.
We are a small team. We will acknowledge your report as soon as we can, usually within a few business days, keep you informed as we investigate, and work with you on a coordinated disclosure timeline. We will credit you when we publish the fix unless you prefer to stay anonymous.
Research conducted in good faith under this policy is authorized as to claims we control. We will not sue or refer you to law enforcement for such research unless you access or retain personal data, demand payment, cause harm, or breach these guidelines. Third-party systems and legally required reporting are excluded.
CoralMind publishes evaluation material about mental health, including crisis situations. If you find published material that you believe poses a safety risk — for example, content that could function as harmful instructions, or clinical material that appears to lack required consent or de-identification — report it through the same private channels. Do not describe it in a public issue. We treat these reports with the same priority as security vulnerabilities.
During the pre-1.0 period, only the latest release and the main branch of each project receive security fixes.