Praxis AI is pre-1.0.0. Only the latest patch release of the current minor line receives security updates. Older pre-release lines become unsupported when a new minor line is released.

Please report security vulnerabilities by emailing security <at> praxis <dot> fast. Do not open a public issue.

Include:

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Any potential mitigations you have identified

Prior to v1.0.0, we coordinate disclosure and remediation timelines with researchers individually. We will publish a standardized response timeline before the first stable release.

We use the following severity levels:

• Critical: Remote code execution, authentication bypass, or data exfiltration without user interaction
• High: Denial of service with amplification, privilege escalation, or significant data exposure
• Medium: Denial of service requiring sustained effort, information disclosure of limited scope
• Low: Issues requiring unlikely configurations or minimal impact

We consider security research conducted in good faith to be authorized. We will not pursue legal action against researchers who follow this policy and report findings responsibly. We appreciate your help making Praxis AI more secure.