Please report security issues privately. Do not open a public issue.
| Version | Supported |
|---|---|
| 0.1.x | Yes |
- Never commit API keys. All LLM provider keys are read from environment variables
(
OPENAI_API_KEY,ANTHROPIC_API_KEY,GEMINI_API_KEY). - The
config.yamlshould not contain secrets; use environment variables instead. - The default provider is
mock(offline, deterministic) — no network or keys required. - Audit logs are append-only JSONL; rotate them for long-running deployments.