Security

Reporting and hardening

How to report a vulnerability, which versions are supported, and how to harden a deployment.

Disclosure policy

Report vulnerabilities to [email protected]. Include the affected version, a description of the issue, and a proof of concept where you can. We respond within a few business days and will credit reporters unless you ask us not to.

Do not open a public issue for a vulnerability. We will coordinate a fix and a disclosure with you.

Supported versions

The latest tagged release is supported. Fixes land on the current branch and are published in the next release. Older releases are not backported.

Hardening notes

Serve the application over HTTPS in production.
Keep ALLOW_INSECURE_COOKIE off. Enable it only on a private network over plain HTTP.
Bind the detection service to localhost unless another host must reach it.
Run the adjudicating model on your own network when the data requires it.
Keep PHILOTAS_LLM_URL pointed at an endpoint you control.