Merge branch 'lab/credit' into 'export/v1-2-2'

Add security researcher credit for CWE-502 finding

See merge request onecomp/onecomp-lab!105

Author: FKKimura

CHANGELOG.md

@@ -14,6 +14,7 @@
   - **Breaking change**: existing callers of `load_quantized_model_pt()` must pass `allow_unsafe_deserialization=True` for trusted `.pt` files.
 - **`Quantizer.load_results()` / `ResultLoader`**: same hardening applied. Loading with `weights_only=False` now requires `allow_unsafe_deserialization=True` (added as a `ResultLoader` field), and logs a warning. The safe `weights_only=True` path is unchanged.
 - Updated docstrings, docs, and the LoRA SFT example to document the risk and the required opt-in.
+- **Credit**: this unsafe deserialization issue (CWE-502) was responsibly disclosed by **Nir Yehoshua, Cipher Security Labs**. Thank you for the report.
 
 ## [v1.2.0] 2026-06-08
 

SECURITY.md

@@ -37,3 +37,9 @@ To help us triage and resolve the issue quickly, please include as much of the f
 Please make a good-faith effort to avoid privacy violations, data destruction, and service interruption while investigating. We ask that you give us a reasonable amount of time to address the issue before any public disclosure.
 
 Thank you for helping keep OneComp and its users safe.
+
+## Security Acknowledgments
+
+We thank the following researchers for responsibly disclosing security issues in OneComp:
+
+- **Nir Yehoshua, Cipher Security Labs** — unsafe deserialization in `QuantizedModelLoader.load_quantized_model_pt()` (CWE-502), fixed in v1.2.1.