Repository navigation

Security

SECURITY.md

Security Policy

Reporting

For vulnerabilities, privacy incidents, or credential leaks, use the repository's private vulnerability reporting channel if it is enabled on the hosting platform.
If private reporting is unavailable, open a public issue without exploit details and request a secure follow-up channel from the maintainers.

Response Expectations

Triage target: 3 business days.
Status update target: 7 business days.
Secret exposure reports should include which credential class was exposed so rotation can start immediately.

Scope

Authentication and authorization flaws
Data exposure or cross-user access
Upload, storage, or deletion-policy failures
Prompt injection or model-key leakage that bypasses documented protections

There aren't any published security advisories