auralink is pre-1.0; security fixes land on the latest released minor version.

Please report suspected vulnerabilities privately via GitHub's security advisories rather than opening a public issue.

Include enough detail to reproduce the problem (a minimal snippet using the built-in tiny model is ideal). You can expect an initial response within a few days. Once a fix is available it will be released and the advisory published.

auralink loads checkpoints with torch.load. Only load checkpoints from sources you trust — deserialising an untrusted checkpoint can execute arbitrary code. The optional HFCausalLM downloads models from the Hugging Face Hub; the same trust considerations apply.