We take security seriously. If you discover a vulnerability in any AiLydian repository, please report it responsibly through our coordinated disclosure process.

1. DO NOT create a public GitHub issue for security vulnerabilities.
2. Use GitHub Private Vulnerability Reporting for any repository under this organization.
3. Alternatively, email security@ailydian.com with the subject line [SECURITY] <repo-name> and include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact assessment
   • Affected version(s)
   • Any suggested fixes (optional)

In scope:

• Application code vulnerabilities (all repositories)
• Authentication and authorization flaws
• Data exposure, injection, and XSS issues
• API security (IDOR, BOLA, mass assignment)
• Dependencies with known CVEs (CVSS ≥ 7.0)
• HIPAA/KVKK data handling violations

Out of scope:

• Social engineering attacks
• Volumetric denial-of-service (DoS/DDoS)
• Self-XSS requiring user interaction