If you discover a security vulnerability, please send an email to security@example.com.

Please do not open a public issue.

We will respond within 48 hours and work with you to address the issue.

• NEVER commit .env files or files containing API keys
• Use .env.example as a template
• Store secrets in environment variables or secret management systems
• Rotate API keys regularly

• Vector stores and cached data are excluded from git
• User queries and responses are not logged by default
• Enable structured logging only in secure environments

• Chrome MCP runs in sandboxed mode
• Web scraping respects robots.txt
• Rate limiting applied to external requests
• Scraped content cached locally (not committed)

• Use HTTPS in production
• Enable authentication/authorization
• Apply rate limiting
• Monitor for unusual activity
• Keep dependencies up to date

# Recommended production settings
USE_LLM=true
ENABLE_WEB_ENHANCEMENT=false  # Disable if not needed
CHROME_HEADLESS=true
LOG_LEVEL=WARNING  # Don't log sensitive data

We use:

• uv for dependency management with lock files
• Automated dependency scanning
• Regular security updates

Last security audit: 2026-06-09 Next scheduled audit: 2026-12-09