Security fixes target the latest code on the default branch and the latest tagged release, when one exists. Older snapshots may not receive backports.

Email davidyang042@gmail.com with the subject TreeAI security report.

Include:

• the affected version or commit;
• a clear description of the issue and impact;
• minimal reproduction steps or a proof of concept;
• relevant browser, provider, and operating-system details;
• suggested remediation, if known.

Do not include live API keys, private conversations, unrelated personal data, or destructive payloads. Do not open a public issue until the report has been reviewed and a coordinated disclosure plan has been agreed.

TreeAI is a client-only browser application:

• model API keys are stored unencrypted in IndexedDB;
• requests are sent directly from the browser to the configured provider;
• TreeAI does not provide a relay server, account system, or cloud backup;
• browser extensions, injected scripts, shared profiles, and compromised origins may access local data.

Use restricted credentials, prefer a trusted local proxy when possible, and do not configure TreeAI on shared or untrusted devices.

Useful reports include credential exposure, cross-site scripting, unsafe export handling, storage-boundary bypasses, dependency vulnerabilities with a demonstrated path, and provider-request behavior that leaks secrets.