Security

Report a vulnerability

SECURITY.md

Security Policy

Reporting a Vulnerability

If you discover a security vulnerability, please report it responsibly:

Do NOT open a public issue
Email the maintainer or use GitHub's private vulnerability reporting
Include steps to reproduce the vulnerability
Allow reasonable time for a fix before public disclosure

Scope

This project runs a local HTTP server (port 9889) with SQLite. Security considerations:

API authentication: Optional API key via AC_API_KEY environment variable
No remote access by default: Server binds to localhost only
No secrets in code: All credentials are loaded from environment variables
SQLite: No external database connections or credentials

Supported Versions

Version	Supported
0.9.x	Yes
< 0.9	No

There aren't any published security advisories