1# 🔒 Security Policy for Poulpy
 2
 3## Report a Vulnerability
 4
 5To report a vulnerability, please contact us at: **[jean-philippe@phantom.zone](mailto:jean-philippe@phantom.zone)**
 6
 7Include in your report (if possible):
 8
 9* Affected crate
10* Steps to reproduce
11* Impact
12* Potential fix
13
14We will acknowledge receipt and work with you on resolution.
15
16## Security Model
17
18Poulpy implements RLWE-based cryptography and follows the standard **IND-CPA security model** when used with appropriate parameters.
19
20To select secure parameters, we recommend using the [Lattice Estimator](https://github.com/malb/lattice-estimator).
21
22Like other FHE libraries, Poulpy does **not** provide stronger security notions out of the box and users should be aware that:
23
24* FHE ciphertexts are malleable by design and are not inherently CCA-secure.
25* Circuit privacy is not guaranteed without additional techniques (e.g., re-randomization, modulus switching, noise flooding).
26
27Users should therefore design protocols accordingly and apply standard safeguards (e.g., private & authenticated channels, key rotation, limiting decryption queries).
28
29Additional context on security notions beyond CPA can be found in [Relations among new CCA security notions for approximate FHE](https://eprint.iacr.org/2024/812).