We support the latest version on the main branch. Older versions receive critical-severity fixes only on a best-effort basis.

Do not open a public GitHub issue for security vulnerabilities. Instead:

1. Open a private GitHub Security Advisory, or
2. Email security@graycode.ai with the details below.

Include in your report:

• A description of the vulnerability and the affected component.
• Steps to reproduce, ideally with a minimal proof-of-concept.
• The version (git SHA) you tested against.
• The potential impact and any suggested mitigation.

Response targets:

• Initial acknowledgement: within 48 hours.
• Triage and severity assessment: within 5 business days.
• Coordinated fix and disclosure: within 30 days for high/critical, 90 days for medium/low.

We follow coordinated vulnerability disclosure:

• Reporters receive credit in the advisory (unless they opt out).
• We request that reporters refrain from public disclosure until a fix has been released or the disclosure deadline above has elapsed.
• We will not pursue legal action against good-faith researchers acting within this policy.

This policy covers the code in this repository and the release artefacts published from it. It does not cover:

• Third-party dependencies (report to upstream).
• LLM provider services (report to the provider).
• Infrastructure-level configuration of the GitNexus or graphify tools.

• No secrets are committed to this repository.
• The server does not handle authentication or authorization — it is a local development tool.
• Generated HTML files in repos/ and global/ are static and do not execute server-side code.