Report vulnerabilities through this repository's private GitHub security advisory channel when enabled, rather than posting credentials or exploit details publicly.

• Secrets come from environment configuration. .env, raw source documents, vector databases, generated PDFs, and local agent settings are excluded from Git and container build context. Secret fields are omitted from settings repr; Settings.redacted() reports presence only.
• Use a Qdrant key restricted to reading the application's collection at runtime. Keep collection-management and write permissions in a separate operator key used for indexing; the chat application does not need those permissions.
• Browser sessions own their conversation/profile state. There is no account authentication. Public deployment requires an authenticated gateway, request and concurrency limits, TLS, and provider spending limits.
• Health questions and profile fields are sent to Groq; optional food searches go to USDA. Do not submit identifying or sensitive health information. The app is not designed for regulated health records.
• Browser text is rendered with DOM text nodes; only a small set of formatting elements and validated NIH links are created. Model calls cannot execute code or select file paths. The web API serves only same-origin assets, applies a restrictive content security policy, and uses HTTP-only same-site cookies.
• User messages are limited to 4,000 characters and 5,000 request bytes; model history and completion sizes are bounded. HTTP calls have timeouts and a single bounded retry budget.
• Ingestion is an operator CLI, not an upload endpoint. Only ingest documents from reviewed sources into private, trusted filesystem paths. PDF parsing is not a sandbox: use a disposable, resource-limited environment for new PDFs.
• Retrieved evidence is serialized as data, explicitly separated from system instructions, filtered for relevance, and bounded without truncating tables. Missing evidence and invalid citation IDs cause abstention. These controls reduce prompt-injection risk; they do not guarantee semantic faithfulness. Age-specific intake questions prioritize matching source table rows and distinguish recommended intakes from upper safety limits.
• Safety regexes are a limited first layer. System prompts forbid diagnosis and prescribing, but adversarial model behavior remains possible. The OpenFDA utility is not part of the graph and returns safe=None: adverse-event counts cannot establish that a substance is safe.
• PDFs use private, randomly named temporary directories. Replacing a session's PDF deletes its previous file. Container filesystems must remain private and ephemeral; host-level retention cleanup is required for abandoned sessions.
• Application logs contain operation names, counts, timings, and error types, rather than prompts, profile measurements, provider bodies, or generated text. Keep provider tracing disabled and restrict access to deployment logs.

The production container installs requirements.runtime.lock.txt; a current pip-audit run found no known vulnerabilities in that lock. The separately installed CPU PyTorch 2.13.0 was audited by package version with no known findings. The full development/evaluation lock still reports nine findings (including duplicate advisory entries) in three packages for which the database lists no fixed version:

None of these three packages is in the production lock. They remain documented risks in local development and operator evaluation. Re-run both audits on updates and re-evaluate applicability before enabling any affected feature.

Revoke exposed credentials at the provider and replace deployment secrets. Deleting a file or commit does not revoke a credential. Rotating a Qdrant API key does not erase its collection; only a new/empty cluster needs reindexing. Do not rewrite repository history without coordinating with collaborators.

CI runs Gitleaks on repository history. Local scans must also cover the intended working-tree files. Never print secret values in scan reports.

• OWASP RAG security
• OWASP prompt-injection prevention
• FDA API disclaimer