Report suspected vulnerabilities privately through GitHub's Security Advisory flow — never in a public issue, discussion, or pull request:
- Go to the repository's Security tab.
- Choose "Report a vulnerability" to open a private advisory draft.
Include, when known:
- the affected version or commit;
- a reproduction (steps, minimal config, or a fixture);
- the impact (what an attacker gains, what data or action is exposed);
- a suggested mitigation or fix, if you have one.
- Acknowledgment: within 3 business days of the report.
- Status update: within 7 calendar days, including either a fix timeline or an explicit risk decision.
These are targets, not contractual SLAs — korvid is maintained on a best-effort basis.
Only the latest patch in the current published minor line is supported.
The latest release
identifies that line; publishing a new minor line supersedes the previous minor line.
Unpublished tags are audit history, not supported releases. main is
development-only and is not a supported target for security fixes.
Once a report is triaged, disclosure (a public advisory, changelog entry, or issue) is coordinated with the reporter and happens after a fix is released, or after an explicit decision that the report is not a vulnerability, won't be fixed, or requires accepting the residual risk. We will credit reporters who want to be credited.
For the specific data korvid sends to embedded AI providers, what stays
local, and the trust boundaries around the MCP server and provider plugins,
see docs/threat-model.md.