Email contact@identixia.com with the subject Security report: product name. Do not disclose an unpatched vulnerability in a public issue or pull request.

Include the affected product and version, platform, impact, reproduction steps, and a minimal proof of concept using synthetic data. Do not attach production credentials, license keys, biometric templates, face images, or identity documents. Ask for a suitable private transfer method if sensitive evidence is necessary.

Contact support to confirm security-update availability for your deployed SDK version and license. Product-specific security policies take precedence over this default policy.