Vector-64 processes local UCI input, positions, networks and datasets. The native visualizer is an unauthenticated loopback developer tool with file-loading and file-writing controls. It is not a public hosted-service boundary. A server adapter must isolate engine processes and bound requests, output and time.

Use the repository's Security tab to check whether private vulnerability reporting is available. If it is unavailable, open an issue requesting a private reporting channel without publishing exploit details or sensitive data. This repository does not currently publish a dedicated security mailbox or a response SLA; this page does not invent one.

Repository API verification on 2026-10-19 reported private vulnerability reporting disabled. Enabling it is a maintainer repository-setting action; this documentation does not announce an enabled channel. Recheck the current Security tab before reporting, because that setting can change independently of the source tree.

Include the affected revision/platform, input type, impact, minimal reproduction, and whether the issue is reachable through UCI, a network file, training data, or the local visualizer. Share full exploit details only through the agreed private channel.

• Train/export only from trusted PyTorch checkpoints; current loaders allow pickle deserialization.
• Keep visualization bound to loopback; do not expose it through an unrestricted reverse proxy.
• Validate and isolate externally supplied positions, files and process runs.
• Do not continue using a worker after a failed network replacement; see the known loader defect.

Current CI includes sanitizers and protocol checks, but that is not a security certification. No maintained backport/support window is declared here; reports should identify the exact release and whether current source is affected.