Use the MedMLX private vulnerability reporting form for vulnerabilities in MedMLX repositories and packages. If the affected repository has its own security policy, follow that policy instead.

Include the affected repository, package version or Git revision, expected impact, and a minimal synthetic reproduction. Keep exploit details private until a fix and disclosure have been coordinated with maintainers. Do not put patient data, credentials or private weights in reports, issues or fixtures.

Identify whether the issue affects source code, a dependency, checkpoint conversion, a model checkpoint or a dataset. These components have separate owners and terms. For an upstream component, include its publisher and exact version or revision so maintainers can coordinate with the upstream project.

Use the affected repository's documented local checks. Model parity and engineering tests do not establish clinical validity.