Report a vulnerability privately through GitHub's private vulnerability reporting: the Report a vulnerability button under the repository's Security tab. Do not open a public issue for it. If the button is not available, contact a maintainer through the contact details on their GitHub profile, without describing the vulnerability in a public place.

A report states the affected version or commit, the operating system, architecture and device, the smallest input that reproduces the behaviour, its observed impact, and any known mitigation. The maintainers acknowledge the report and communicate their assessment and any remediation through the private advisory. Disclosure follows the release of a fix or an agreed date, and reporters are credited unless they ask not to be.

Vulnerabilities in the embedded BART, FINUFFT, PyTorch or another dependency are reported to that project as well; a report here then concerns how bartorch is affected.

bartorch is pre-alpha. Fixes are made on the default branch and released in the next version; earlier releases are not maintained.