ternlight is in pre-alpha. The project is small enough that we don't yet run a formal disclosure program, but we take security reports seriously.

If you find a security issue, please do not open a public GitHub issue.

Instead, email wenshutang@gmail.com with:

• A description of the issue and its impact
• Steps to reproduce (or a proof-of-concept)
• Affected version, commit, or release

I aim to acknowledge reports and to coordinate a fix and disclosure timeline with you before publishing details.

In-scope:

• The compiled WASM engine under engine/
• The published ternlight npm package under packages/ternlight/
• The training and packing pipeline under training/

Out-of-scope:

• The demo sites under examples/ (deployed for illustration only)
• Vulnerabilities in third-party dependencies — please report those upstream

For correctness, performance, or quality issues that aren't security-relevant, please open a GitHub issue.