Security fixes are applied to the latest revision on the main branch. The current public research release is version 0.1.x.

Use GitHub's Report a vulnerability feature to submit a private security advisory. Please do not open a public issue for suspected credential exposure, dependency compromise, unsafe file handling, or unintended disclosure of licensed market data.

If the private reporting button is unavailable, open a minimal issue requesting a private contact channel, but do not disclose vulnerability details, credentials, proprietary data, or personal information in that issue.

Include a concise description, affected files or commands, reproduction steps, and the potential impact. Do not include live credentials, proprietary datasets, or personal information in the report. Acknowledgement and remediation timing depend on severity and reproducibility.

Questions about factor definitions, empirical results, or investment interpretation are research discussions rather than security reports and may use the normal issue tracker.