Security and responsible disclosure

Last updated: [EFFECTIVE_DATE]

If you find a security problem in flux-llm.com or Flux OS, please tell us privately so it can be fixed before it is made public.

How to report

Please do not open a public GitHub issue for a security problem.

What to include

  • What is affected: a URL, or a Flux OS version or commit.
  • Steps to reproduce, and a proof of concept if you have one.
  • What an attacker could do with it.
  • How you would like to be credited, if at all.

What we ask

Test only against your own installs or accounts. Do not access, change or delete other people's data, do not degrade the site for others, and give us reasonable time to fix the problem before you disclose it.

What happens next

We will acknowledge your report within [SECURITY_ACK_TIME], keep you updated while we work on it, and credit you when the fix is released if you want. There is no paid bug bounty.

Scope

In scope: the flux-llm.com website and the Flux OS repository. For Flux deployments under a paid agreement, report issues through the contact named in that agreement or by email.