Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them privately using one of the following methods:

1. Go to the Security Advisories page
2. Click "New advisory"
3. Fill in the details of the vulnerability
4. Submit as "Private" — this creates a confidential channel with the maintainer

Send a detailed report to aslan08_05@mail.ru with the subject line:

[SECURITY] research-papers: <brief description>

• Description of the vulnerability and its impact
• Steps to reproduce the issue (code snippet, proof of concept)
• Affected versions — which version(s) are vulnerable
• Suggested fix — if you have one
• Your contact information — for follow-up questions

This repository employs multiple layers of security:

• Pinned action versions — All GitHub Actions use SHA-pinned references
• Minimal permissions — Workflows use least-privilege permissions: blocks
• Harden Runner — Uses step-security/harden-runner for CI hardening
• Dependency lockfile — All Python deps pinned in pyproject.toml

• Signed commits — Recommended for all contributors
• Branch protection — main branch requires PR review + passing CI
• Pre-commit hooks — Automated code quality enforcement on every commit

1. Never commit secrets — API keys, tokens, passwords, or private keys
2. Use environment variables — For any sensitive configuration
3. Pin dependencies — Specify exact versions in requirements
4. Review your diffs — Before every commit, check for accidentally included secrets
5. Report responsibly — Follow coordinated disclosure (see above)

• Numerical precision: Some verification computations use floating-point arithmetic. Results should be independently verified with arbitrary-precision libraries (mpmath, Arb) for security-critical applications.
• Proof assistant trust: Formal verification relies on the correctness of the proof assistant's kernel. Lean 4, Coq, and Isabelle all have small, audited trusted computing bases, but no system is provably bug-free.
• Supply chain: Third-party dependencies (NumPy, SciPy, LAPACK) are trusted. Critical results should be verified with independent implementations.

We continuously monitor our security posture using the OpenSSF Scorecard. Current scores are available at the link above.