If you discover a security vulnerability, please report it responsibly:

1. Do NOT open a public GitHub issue.
2. Prefer GitHub's private reporting flow from the Security tab or the repository's advisory form: https://github.com/jackbatzner/copilot-insights/security/advisories/new.
3. If the advisory form is unavailable, contact the maintainer privately before sharing any details.
4. Include a description of the vulnerability, steps to reproduce, and potential impact.

We will acknowledge receipt within 48 hours and aim to release a patch within 7 days for critical issues.

Copilot Insights is a local-only development tool:

• The server binds to 127.0.0.1 (localhost only) — it is not accessible from the network.
• CORS is restricted to localhost origins.
• The app reads your local Copilot session database (~/.copilot/session-store.db) in read-only mode.
• Goal data is stored locally at ~/.copilot/insights-goals.json.
• No data is transmitted to external services.
• No authentication is required because the server is only accessible to the local user.

• The POST /api/practice/analyze endpoint enforces a 10,000 character input limit and validates that the body contains a string.
• The GET /api/practice/library endpoint validates tag query parameters against a whitelist of known tags — unrecognized tags are silently dropped.
• The GET /api/practice/challenge and GET /api/practice/weaknesses endpoints validate timeframe parameters with a strict pattern (\d{1,4}[dwmy] or all).
• The Express JSON body parser is limited to 50 KB.
• All regex patterns used for prompt analysis are designed to avoid catastrophic backtracking (ReDoS). Greedy quantifiers like .* are bounded (e.g., .{0,200}?) and nested quantifiers use explicit upper bounds.

• JSON body parser limit: 50 KB (express.json({ limit: "50kb" }))

On startup, src/db.mjs validates the session-store schema before executing queries. Required tables (sessions, turns, session_files) must be present or the server exits with a descriptive error. Optional tables (session_refs, checkpoints) degrade gracefully — features that depend on them return empty results and a console warning is logged. This prevents confusing SQLite errors when the database is from an incompatible Copilot CLI version.

All database queries use parameterized statements via better-sqlite3's .prepare().all() / .get() API. No user input is interpolated into SQL strings.

All 130+ regex patterns (in src/patterns.mjs and other analysis modules) have been audited for ReDoS. None use nested quantifiers, unbounded .+/.* in dangerous positions, or overlapping alternations.

All endpoints are read-only (GET) except where noted. The server exposes: