Email gbranaa4@gmail.com with "SECURITY" in the subject. Do not open a public issue for a security report.
Include what you found, how to reproduce it, and the impact. You'll get an acknowledgement within a few days. Single-maintainer project, no bug-bounty budget — you get a fix, changelog credit if you want it, and a straight answer.
MethodLM loads tabular data and can drive a language model. Worth reporting:
- loading a crafted dataset (CSV / JSON / Parquet / SQLite /
.npz/ Excel) causing code execution rather than just featurisation - the SQLite path (
--table/--query) allowing injection beyond the intended read - the desktop GUI (
methodlm_gui.py, serves a local browser UI) being reachable off-host or accepting input it shouldn't - the ledger or audit JSON leaking secrets (API keys, file contents) that were never meant to be written
Out of scope: you supplying your own ANTHROPIC_API_KEY and it appearing in your
own local ledger; costs from your own frontier-model runs (set a workspace spend
limit).
The latest tag on main is supported. Earlier tags are not patched.