From bed58c4d43695ba263a04c0ba3536934f3bca4ce Mon Sep 17 00:00:00 2001 From: Azimml Date: Fri, 24 Jul 2026 16:39:05 +0500 Subject: [PATCH] docs: add SECURITY.md --- SECURITY.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..6d36dca --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,13 @@ +# Security Policy + +## Reporting a Vulnerability + +If you discover a security issue in onnx-graph-diff (for example, a crafted ONNX +model that causes unsafe file access during parsing, or a prompt-injection path +in the LLM-assisted matching routes), please open a private security advisory or +an issue with a reproduction. Do not include real API keys in reports. + +## Notes + +- LLM API keys are read from environment variables only and are never logged. +- The tool never executes models; it performs static graph analysis.