Status: draft.

Use the private GitHub Report a vulnerability form. Sign in to GitHub to submit a report. Do not put a vulnerability, a key or private data in a public issue.

Include the affected version, the impact and a minimal reproduction. Use dummy keys and synthetic data.

Reports apply to the latest release on PyPI. This policy does not promise a response deadline or fixes for older releases.

The security reference lists the data that typevet sends to a backend. It also covers API key masking and redaction in diagnostic events.