If you find an unsafe command, a vulnerability, or material that should not be public, please tell us privately through the repository's security advisory form. If that form is unavailable, contact a repository maintainer through the lab's usual private channel. Please do not open a public issue for the initial report.

Share enough for us to locate the problem: the affected file or page, a commit or URL, what could happen, and a safe way to reproduce it. Do not attach PHI, restricted research data, credentials, shortcodes, private cluster paths, or sensitive logs. A description such as “line 18 exposes a token” is safer than copying the token.

For ordinary documentation corrections that contain no sensitive context, a public issue or pull request is welcome.

Remember that approval to run work on Armis2 does not automatically approve an external model, API, repository, issue tracker, or backup destination for the same data.