AutoJSON is a local error aggregation system designed with security and privacy in mind. This document outlines our security practices, how to report vulnerabilities, and our commitment to maintaining a secure open-source project.

• 100% Local Processing: All error data is processed and stored locally on your machine
• No External Services: AutoJSON does not send data to external servers or third-party services
• Localhost Only: The aggregator service runs exclusively on localhost:9000
• Offline Capable: Fully functional without internet connectivity

• Error messages and stack traces may contain sensitive information (user data, API keys, etc.)
• The .autojson_debug_context.json file should be treated as potentially sensitive
• Configuration files may contain domain names and endpoint patterns
• All AutoJSON output files are excluded from version control by default

We provide security updates for the following versions:

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Security vulnerabilities should not be disclosed publicly until a fix is available.

Please report security vulnerabilities through one of these channels:

• GitHub Security Advisories: Report a vulnerability
• Email: Create an issue with the title "SECURITY" and we'll provide a secure contact method

Please provide:

• Description of the vulnerability
• Steps to reproduce the issue
• Potential impact
• Any suggested fixes (if available)
• Your contact information for follow-up

• Initial Response: Within 48 hours
• Status Update: Within 7 days
• Fix Timeline: Depends on severity (critical issues prioritized)

• We will acknowledge your report within 48 hours
• We will provide a detailed response within 7 days
• We will work with you to understand and fix the issue
• We will credit you in the security advisory (unless you prefer to remain anonymous)
• We will coordinate public disclosure after a fix is available

# Ensure these files are in .gitignore
.autojson_debug_context.json
.autojson_filter_config.json
.autojson_history/

• Error messages may contain sensitive data (tokens, user info, API keys)
• Review .autojson_debug_context.json before sharing with LLMs or team members
• Consider sanitizing data in production environments

{
  "frontend": {
    "domain_whitelist": ["localhost", "yourdomain.com"],
    "message_blacklist": ["API_KEY=", "token=", "password="]
  }
}

• Never expose the AutoJSON service (port 9000) to the internet
• Use firewall rules to restrict access to localhost
• Do not bind to 0.0.0.0 or public IP addresses

# Regularly update dependencies to get security patches
pip install --upgrade -r requirements.txt

# Isolate AutoJSON dependencies
python -m venv venv
source venv/bin/activate  # On Windows: venv\Scripts\activate
pip install -r requirements.txt

• API keys, tokens, passwords
• Personal data or PII
• Production credentials
• Real error logs with sensitive data

• Create sanitized test fixtures
• Use placeholder values for tests
• Generate synthetic error data

• No hardcoded credentials
• No sensitive data in tests
• Input validation for all endpoints
• Proper error handling
• No arbitrary code execution risks
• Dependencies are pinned and trusted

# Run tests before committing
pytest tests/ -v

# Check for common security issues
pip install bandit safety
bandit -r autojson_core/
safety check

• AutoJSON writes to local files (.autojson_debug_context.json)
• Ensure proper file permissions in your environment
• Files are created with default user permissions

• Error messages may inadvertently contain sensitive data
• Users should configure filters to exclude sensitive patterns
• Consider sanitizing error messages in production

• Chrome extension captures errors from web pages
• CORS policies prevent access to cross-origin script contents
• This is a security feature, not a bug

• Backend stack traces may reveal code structure
• This is intended for debugging but should be protected
• Do not expose .autojson_debug_context.json publicly

• Be cautious when sharing error data with external LLM services
• Consider data residency and privacy policies
• Use local LLM solutions for sensitive projects

Security updates will be:

• Released as soon as possible after discovery
• Announced in the repository's Security Advisories
• Documented in CHANGELOG.md
• Tagged with version bumps according to severity

AutoJSON uses minimal dependencies to reduce attack surface:

• fastapi - Web framework (regularly updated)
• uvicorn - ASGI server (security-focused)
• pydantic - Data validation (prevents injection attacks)
• httpx - HTTP client (actively maintained)

We monitor dependencies for vulnerabilities using:

• GitHub Dependabot
• Security advisories
• Community reports

• Critical vulnerabilities: Immediate update
• High severity: Update within 7 days
• Medium/Low: Update in next release

No security vulnerabilities have been reported or discovered to date.

When vulnerabilities are disclosed, they will be listed here with:

• CVE identifier (if applicable)
• Severity level
• Affected versions
• Fixed versions
• Mitigation steps

• GDPR: AutoJSON processes data locally; users control all data
• CCPA: No data collection or sale
• HIPAA/PCI-DSS: Not certified; users responsible for sanitizing sensitive data

• MIT License - see LICENSE
• No warranty or liability for security issues
• Use at your own risk in production environments

If you plan to use AutoJSON in a production environment:

• Review and sanitize all error messages
• Configure strict filters to exclude sensitive patterns
• Ensure .autojson_debug_context.json is not committed to version control
• Restrict service access to localhost only
• Use HTTPS for any remote LLM integrations
• Implement log rotation for error archives
• Regular security audits of error data
• Keep dependencies updated
• Monitor for unusual error patterns
• Have an incident response plan

• Security Issues: GitHub Security Advisories
• General Issues: GitHub Issues
• Discussions: GitHub Discussions

We thank the security research community for helping keep AutoJSON secure. Security researchers who responsibly disclose vulnerabilities will be acknowledged in our security advisories (with permission).

Last Updated: February 2026
Version: 1.0

• OWASP Top 10
• Python Security Best Practices
• FastAPI Security
• GitHub Security Best Practices