This project is pre-1.0. Security fixes are handled on the latest supported development line only.
If a release branch is published later, the latest release line and main will be the supported targets unless stated otherwise.
Do not post exploit details in a public GitHub issue.
Preferred path:
- Use GitHub Security Advisories for this repository if private reporting is enabled.
- If private reporting is not available, open a minimal public issue without exploit details and ask maintainers for a private reporting channel.
Include:
- affected version, branch, or commit
- exact component or file path
- reproduction steps
- impact assessment
- any suggested mitigation
- Maintainers will acknowledge the report when possible.
- We will validate the issue, assess severity, and coordinate a fix before public disclosure when practical.
- Please avoid publishing proof-of-concept details until maintainers have had a reasonable chance to respond.
- LRS is intended for local-first deployment.
- Default server bind is localhost unless explicitly overridden.
- Evidence extraction blocks localhost and private-network fetch targets by default.
- Exposing the API to untrusted networks is not recommended without additional review and hardening.
- Do not include secrets in issues, logs, screenshots, or sample configs.
- Review
.env,.env.local, and local config files before sharing repro steps. - Treat connected search and LLM backends as part of your local trust boundary.