The following versions of LAKER are currently supported with security updates:

If you discover a security vulnerability in LAKER, please report it responsibly.

Please do not disclose security issues publicly (e.g., via GitHub issues) until we have had a chance to address them.

Instead, send an email to the maintainers with:

• A description of the vulnerability
• Steps to reproduce (if applicable)
• The potential impact
• Any suggested fixes or mitigations

We will acknowledge receipt within 48 hours and aim to provide an initial assessment within 5 business days. We ask that you allow 90 days after we acknowledge the report before publicly disclosing the vulnerability, to give us time to develop and release a fix.

When using LAKER:

• Keep dependencies up to date (pip install -U laker)
• Only load model checkpoints from trusted sources
• Be cautious when running untrusted example scripts
• Review model files before loading (untrusted Pickle files can execute arbitrary code)