Security Policy

How to report security vulnerabilities in AlpaSim

NVIDIA is dedicated to the security and trust of our software products and services, including all source code repositories managed through our organization.

Do not report security vulnerabilities through GitHub.

Please use the appropriate contact points outlined below.

Reporting a Security Vulnerability

To report a potential security vulnerability in any NVIDIA product:

Contact Methods

Web Form

Security Vulnerability Submission Form

Email

[e-mail]

Download NVIDIA PGP Key for secure communication

Information to Include

When reporting a security issue, please include the following information:

1. Product Information

   Product/Driver name and version/branch that contains the vulnerability

2. Vulnerability Type

   Type of vulnerability (code execution, denial of service, buffer overflow, etc.)

3. Reproduction Steps

   Instructions to reproduce the vulnerability

4. Proof of Concept

   Proof-of-concept or exploit code (if available)

5. Impact Assessment

   Potential impact of the vulnerability, including how an attacker could exploit it

Example Report Template

**Product/Version**: AlpaSim v2.3.26

**Vulnerability Type**: [e.g., Code Execution, DoS, Buffer Overflow]

**Description**: [Detailed description of the vulnerability]

**Reproduction Steps**:
1. [Step 1]
2. [Step 2]
3. [Step 3]

**Proof of Concept**:
[Code or detailed exploit steps]

**Impact**:
[Description of potential impact and exploitation methods]

**Suggested Fix** (optional):
[Your suggestions for addressing the vulnerability]

Secure Email Communication

We encourage you to use PGP encryption for secure email communication:

NVIDIA PGP Key

Download the NVIDIA public PGP Key for encrypted communication with PSIRT.

Coordinated Vulnerability Disclosure

While NVIDIA currently does not have a bug bounty program, we do offer acknowledgement when an externally reported security issue is addressed under our coordinated vulnerability disclosure policy.

For more information, visit the Product Security Incident Response Team (PSIRT) policies page.

Response Process

Initial Response

You will receive an acknowledgement of your report within a reasonable timeframe.

Investigation

Our security team will investigate the reported vulnerability and determine its severity and impact.

Resolution

If the vulnerability is confirmed, we will work on a fix and coordinate the disclosure timeline with you.

Acknowledgement

You may be acknowledged in our security advisories if you choose (anonymous reports are also accepted).

NVIDIA Product Security

For all security-related concerns, please visit:

NVIDIA Security Portal

Visit the NVIDIA Product Security portal for security advisories, policies, and resources.

Security Best Practices

When using AlpaSim, consider the following security best practices:

• Never commit sensitive credentials or API keys to the repository
• Use environment variables for secrets (e.g., HF_TOKEN)
• Keep dependencies up to date
• Review security advisories regularly
• Use secure communication channels for sensitive data

Next Steps

Contributing

Learn how to contribute securely

License

View license information