Please do not open a public issue for a suspected security vulnerability.

Use GitHub's Private vulnerability reporting / Security advisory flow for this repository so details can be reviewed before public disclosure.

When reporting, include:

• affected version or commit
• minimal reproduction steps
• impact assessment
• platform/compiler information
• suggested mitigation, if known

We will triage reports as quickly as practical and coordinate disclosure after a fix or mitigation is available.

Security-sensitive areas include GGUF parsing, tokenizer handling, model-file bounds checking, memory mapping, quantized kernel indexing, thread synchronization, and any future network-facing components.