6c7eed7580
Fresh history cut from cynarAI/evoo antigravity-handoff/project-timeline (Voice First + project timeline). Brand docs/titles as evOo; keep @rakazo/* packages as tech debt. Excludes node_modules, caches, secrets, voice blobs.
35 lines
892 B
Markdown
35 lines
892 B
Markdown
# Security
|
|
|
|
## Reporting vulnerabilities
|
|
|
|
Email **security via GitHub private advisory / cynarAI** only. Do not open public GitHub issues for security bugs.
|
|
|
|
Please include:
|
|
|
|
- Steps to reproduce
|
|
- Impact (what an attacker could do)
|
|
- Whether the issue is already public
|
|
|
|
We will acknowledge your report and work on a fix. Please do not file a public issue for unfixed vulnerabilities.
|
|
|
|
## Other contact
|
|
|
|
- General support: **repo owner (cynarAI)**
|
|
- Maintainer: **cynarAI**
|
|
|
|
## Scope
|
|
|
|
This policy covers the evOo self-hosted product in **this repository**.
|
|
|
|
Out of scope:
|
|
|
|
- Third-party AI models and their APIs
|
|
- Composio, E2B, and other external services
|
|
- Operator misconfiguration (exposed secrets, open databases, weak passwords)
|
|
|
|
## Supported versions
|
|
|
|
We support security fixes on the current `main` branch and the latest release (beta).
|
|
|
|
There is no bug bounty program at this time.
|