If you believe you have found a security vulnerability in ZenML, please report it privately, even if you are not certain that it is exploitable.

Submit the vulnerability through GitHub Private Vulnerability Reporting. From the repository's Security page, open Advisories, select Report a vulnerability, and complete the private report form.

Please include as much of the following information as possible:

• A description of the vulnerability and its potential impact.
• The affected ZenML versions, components, and deployment configuration.
• Reproduction steps and a minimal proof of concept, where available.
• Any known mitigations or workarounds.
• How you would like to be credited if the vulnerability is disclosed.

Do not include credentials, secrets, or personal or customer data in your report.

If you cannot use GitHub Private Vulnerability Reporting, email security@zenml.io. Please include the same information requested above.

We will review your report and coordinate with you as we investigate and, when appropriate, prepare a fix and security advisory. Please do not open a public GitHub issue or otherwise disclose the vulnerability publicly until we have agreed on a coordinated disclosure timeline. This helps protect ZenML users while the report is being assessed and addressed.