USC releases receive security vulnerability updates according to the following schedule:

The USC development team takes the security of our Zero-Trust Skill Compiler very seriously. If you discover a security vulnerability, please do NOT create a public issue.

Please report vulnerabilities via:

1. GitHub Security Advisories: Submit a private advisory directly on the repository.
2. Email: Send vulnerability details to security@usc-project.internal or contact project maintainers.

Please include:

• A descriptive summary of the vulnerability
• Exact steps to reproduce or Proof of Concept (PoC)
• Potential impact and affected components (e.g., attestation verify, adapter sandbox, pipeline clean-room)
• Any proposed mitigations or fixes

We aim to respond to initial reports within 48 hours and provide a CVE/advisory with patch remediation.