Security fixes are applied to the latest release and the main branch.

Do not open a public issue for suspected vulnerabilities. Use GitHub private vulnerability reporting when it is enabled for the repository, or contact the maintainer through the private channel listed in the GitHub organization.

Include affected versions, reproduction steps, impact and any suggested mitigation. Do not include customer documents or credentials in the report.

The application does not implement end-user authentication. Docker Compose therefore binds to 127.0.0.1 by default. Do not expose the application port directly to the internet. External deployments must use TLS and authentication at a reverse proxy, VPN or customer-controlled gateway, plus request-size and rate limits.

Model credentials and Feishu credentials must be injected through environment variables. Never store them in rules, templates, test fixtures, logs or Git.

React Router is used only as a client-side BrowserRouter; this project does not use React Router SSR, RSC, actions, loaders or server-framework features. The dependency audit may report advisories for those unused server features. Any advisory affecting client-side navigation remains release-blocking.