For all Gaia security-related defects, please send an email to security@gaianet.ai. You will receive an acknowledgment mail within 24 hours. After that, we will be sure to give a detailed response about the next step in 48 hours. Please do not submit security vulnerabilities directly as GitHub Issues.

We will disclose known public security vulnerabilities as soon as possible after receiving the report. Vulnerabilities discovered for the first time will be disclosed by the following process:

• The received security vulnerability report shall be handed over to the security team for follow-up coordination and repair work.
• After the vulnerability is confirmed, we will create a draft Security Advisory on Github that lists the details of the vulnerability.
• Invite related personnel to discuss about the fix.
• Fork the temporary private repository on Github, and collaborate to fix the vulnerability.
• After the fix code is merged into all supported versions, the vulnerability will be publicly posted in the GitHub Advisory Database.