# Security Policy

## Reporting a Vulnerability

If you find some security vulnerability, please immediately inform at [`ali dot abbasjaffri [at] live dot com`](mailto:ali.abbasjaffri@live.com?subject=Security-Vulnerability-Report-mlinfra) and i will get back to you as soon as possible.

Please refrain from reporting the vulnerability publically. In order for us to best respond to your report, please include any of the following:

- Steps to reproduce or proof-of-concept
- Any relevant tools, including versions used

## Response to Security Vulnerabilities
Upon receiving a security vulnerability report, our team will:

- Investigate the issue and work towards a timely resolution.
- Keep you informed about the progress of fixing the issue.
- Publicly acknowledge your contribution in the project's release notes, unless you prefer to remain anonymous.

## Security Updates and Patching
- `mlinfra` is currently under active development and the team would be releasing a new version every 2-3 weeks. We always recommend users to move to a newer version when it became available, and we only provide security updates in the latest version.
- We release patches for security vulnerabilities as soon as a fix is available and our users are encouraged to regularly update to the latest version of the software.
