Security fixes are applied to the main branch. Self-hosters should track main or a tagged release once published.

Do not open public GitHub issues for security vulnerabilities. Report them privately through GitHub Security Advisories.

Codevil sandboxes execute untrusted LLM-generated code in isolated containers. Treat every session as hostile input.

Deployment secrets, required credentials, and production hardening guidance are documented in .env.example and PRODUCTION_READINESS.md.