Report vulnerabilities privately to erwin.lejeune15@gmail.com with [SECURITY] in the subject. Do not open a public issue — the issue tracker is public and a report there is a disclosure.

Include what you can of:

• the affected repository and version or commit,
• a reproduction (for the planning tools this usually means a domain and problem file, or the input that triggers the behaviour),
• the impact as you understand it.

• Acknowledgement within 7 days of your report.
• An assessment and, where the report is confirmed, a fix plan within 30 days.
• Credit in the release notes for the fix, unless you ask otherwise.
• Coordinated disclosure: we ask that you hold publication until a fix is released, and we will not sit on a confirmed report for more than 90 days.

These libraries parse untrusted input — PDDL files, JSON problem descriptions, map files. Parser crashes on malformed input are ordinary bugs and belong in the issue tracker; report them privately only if the crash is exploitable (memory unsafety, code execution, resource exhaustion that survives a timeout).