Security

docs/SECURITY.md

Security Policy

1. Secrets Management

NEVER commit .env files.
NEVER embed keys in code.
ALWAYS use environment variables.

Incident Response: Leaked Key

If a secret (API Key, Database URL) is committed to Git:

Rotate the key immediately at the provider (AWS, OpenAI, DB Host).
Purge the secret from Git history using git filter-repo or start a fresh repo.
Audit logs for unauthorized usage during the exposure window.

2. Dependencies

Run pip audit and npm audit regularly before major releases.
Keep requirements.txt pinned.

3. Databases

Ensure dev_local.db (SQLite) is never deployed to production.

There aren’t any published security advisories