This policy covers every repository in the unslothai organization, including Unsloth, Unsloth Studio, Unsloth Desktop, unsloth-zoo and the notebooks.

Please do not open a public issue, pull request or discussion for a security problem.

Report it privately, in either of these ways:

• GitHub private vulnerability reporting: open the affected repository's Security tab and click Report a vulnerability.
• Email: daniel@unsloth.ai

Please include the affected repository and version or commit, the steps to reproduce, and the impact you expect. A proof of concept and a suggested fix are welcome.

• We aim to acknowledge reports within 7 days.
• We will keep you updated while we investigate and fix the issue, and credit you in the advisory or release notes unless you prefer otherwise.
• Please give us a reasonable chance to release a fix before disclosing publicly.

Security fixes go into the latest release and the main branch. Please reproduce on the latest version before reporting.