continual-learning-poc is a small research project for studying catastrophic forgetting and continual learning. It trains and runs models locally via the CLI — it has no server component, no network listener, and does not process untrusted external input by design. That said, dependency vulnerabilities, unsafe deserialization of checkpoint/config files, or issues in the training/eval pipeline are all in scope.

This project has not yet reached a 1.0.0 release. Only the latest commit on main is supported — please make sure you're on the latest version before reporting.

Please do not open a public issue for a security concern. Instead, use GitHub's private vulnerability reporting:

1. Go to the repository's Security tab.
2. Select Report a vulnerability.
3. Include what you found, steps to reproduce, and the potential impact.

You should expect an initial response within a few days. This is a spare-time research project, so please be patient — reports are taken seriously regardless of response time.

Realistically, most relevant reports will be about:

• A vulnerable transitive dependency (candle-core, tokenizers, safetensors, etc.)
• Unsafe handling of a malformed or maliciously crafted config.json / tokenizer.json / .safetensors file passed to load_checkpoint
• Any code path that could lead to arbitrary file read/write outside the intended data/ or checkpoints/ directories

Thanks for helping keep this project safe to build on.