中文 | English

如果您发现安全漏洞, 请不要通过公开 Issue 报告。 请通过以下渠道私下报告:

• 邮箱: agentinsightcn@gmail.com
• GitHub Security Advisory (推荐): 使用仓库 "Security" 标签页的 "Report a vulnerability" 功能

• 确认收到: 48 小时内
• 初步评估: 5 个工作日内
• 修复发布: 严重漏洞 30 天内, 一般漏洞 90 天内

仅对最新发布版本 (latest release) 提供安全更新。

本项目为 UI-only 前端演示平台, 同样遵循仓库级安全合规要求:

• 禁止将真实 API Key / JWT / 密码写入源码、文档或日志
• JWT Token 仅存 localStorage(客户端调用) + httpOnly cookie(路由守卫), 禁止写入日志或额外持久化
• middleware.ts 只判断 cookie 是否存在, 不解析 token 内容
• 环境变量模板仅使用占位符, 真实 .env 禁止入仓

• 生产环境强制 HTTPS
• Next.js 安全响应头(nosniff / DENY / HSTS 等)由 next.config.ts 配置
• 前端不直连业务数据库(Postgres/Qdrant/Redis); 业务调用经后端 OpenAI 兼容 API
• CORS / 认证由后端与 AgentInsightService 负责; 前端仅承载 UI 与 API 调用

• Markdown 渲染使用受控组件链路; 不推荐将未消毒 HTML 直接 dangerouslySetInnerHTML
• 用户输入经表单校验后再提交后端

1. 漏洞描述与影响范围
2. 复现步骤 (最小化 PoC)
3. 影响版本 (git commit hash)
4. 建议的修复方案 (如有)
5. 您的联系方式 (用于跟进)

对于确认的有效安全漏洞报告, 我们将在致谢列表中感谢报告者 (除非报告者希望保持匿名)。

If you discover a security vulnerability, please do not report it via public Issues. Report it privately via:

• Email: agentinsightcn@gmail.com
• GitHub Security Advisory (recommended): Use the "Report a vulnerability" feature in the repository "Security" tab

• Acknowledgment: within 48 hours
• Initial assessment: within 5 business days
• Fix release: 30 days for critical vulnerabilities, 90 days for general vulnerabilities

Only the latest release receives security updates.

This project is a UI-only demo frontend and follows repository-wide security rules:

• Never commit real API keys / JWTs / passwords
• JWT is stored only in localStorage + httpOnly cookie; never logged
• middleware.ts checks cookie presence only; it does not parse token contents
• Real .env files must not be committed

• HTTPS is mandatory in production
• Security headers are configured in next.config.ts
• The frontend never talks directly to Postgres/Qdrant/Redis
• Business logic stays in backend agents via OpenAI-compatible APIs

• Markdown rendering uses a controlled component chain
• User input is validated before submission

1. Description and impact scope
2. Reproduction steps (minimal PoC)
3. Affected version (git commit hash)
4. Suggested fix (optional)
5. Your contact information