We actively support security fixes for the following versions of torchxai-explain:

Security fixes are backported to the latest patch release of each supported minor version.

Please do not report security vulnerabilities through public GitHub Issues.

If you discover a security vulnerability in torchxai-explain, please report it responsibly using one of the following channels:

Use GitHub's built-in private vulnerability reporting:

1. Go to the Security tab of the repository.
2. Click "Report a vulnerability".
3. Fill in the details and submit.

This keeps the report confidential until a fix is released.

Please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce the issue (or a minimal proof-of-concept)
• The version(s) affected
• Any suggested mitigations (optional)

We will keep you informed throughout the process. If we need more time to prepare a fix, we will communicate this and agree on a coordinated disclosure date.

This security policy covers the torchxai-explain Python package itself. Vulnerabilities in upstream dependencies (PyTorch, torchvision, etc.) should be reported to their respective maintainers.

• Only load models from trusted sources. torchxai-explain calls torch.load() internally when loading user-supplied checkpoints; loading untrusted .pt / .pth files can execute arbitrary code (a known PyTorch limitation). Use weights_only=True where possible.
• Keep your dependencies up-to-date to benefit from upstream security fixes.
• Do not expose raw model outputs or saliency maps from untrusted inputs in production without appropriate sanitisation.

We appreciate responsible disclosure and will credit reporters in the release notes (with permission) for any confirmed vulnerabilities.