Please DO NOT file a public issue for security vulnerabilities.

Instead, send an email to contact.fardinsabid@gmail.com with:

• Description of the vulnerability
• Steps to reproduce (if applicable)
• Potential impact (what could an attacker do?)
• Suggested fix (if you have one)

1. Confirmation within 48 hours that we received your report
2. Investigation and validation of the issue
3. Fix development (if confirmed)
4. Coordinated disclosure after fix is released

• We will release a patch as soon as possible
• We will credit the reporter (unless you wish to remain anonymous)
• We will publish a security advisory on GitHub

Aleam provides 64 bits of true entropy per call from the operating system's CSPRNG, combined with BLAKE2s cryptographic hashing. This provides:

• Unpredictability: Output cannot be predicted from previous values
• Non-reproducibility: No seeding, each run is unique
• State-free: No internal state to extract

1. Do not use Aleam for security-critical systems without additional entropy sources
2. Do not rely on reproducibility - Aleam is stateless by design
3. Use GPU acceleration for production workloads
4. Keep dependencies updated - regularly run pip install --upgrade aleam

Last Updated: April 2026