If you discover a security vulnerability, please do not open a public issue.

Instead, report it privately:

1. Email the maintainers directly
2. Include a clear description, steps to reproduce, and impact assessment
3. Allow up to 14 days for acknowledgment and an initial fix

We take security seriously and will respond as quickly as possible.

This package is a research library for Information Bottleneck methods. Vulnerabilities to be aware of:

• Pickle/deserialization: torch.load with untrusted checkpoints can execute arbitrary code. Always verify checkpoint provenance.
• YAML parsing: Use yaml.safe_load (not yaml.load) for untrusted config files. Our codebase uses safe_load by default.
• Dependency supply chain: Third-party packages (PyTorch, transformers, etc.) may contain vulnerabilities. Keep dependencies updated.

• 0–48 hours: Initial acknowledgment
• 48 hours–7 days: Investigation and fix development
• 7–14 days: Coordinated disclosure