Security

SECURITY.md

Security Policy

Supported versions

The latest main branch and latest published release are supported.

Reporting a vulnerability

Please do not open public issues for security vulnerabilities.

Report privately to the maintainer and include:

vulnerability summary
reproduction steps
impact assessment
suggested remediation (if available)

Security notes

Service mode is localhost-first by default.
Sensitive action values are redacted in trace export.
Keep API tokens and .env values out of version control.

There aren't any published security advisories