Security and responsible reporting

Website controls

• Production hosting must serve HTTPS; check the deployed domain before sharing it.
• Security headers restrict framing, content sniffing, referrer leakage, and unnecessary browser capabilities.
• The site has no forms that accept project data. Vercel Web Analytics measures aggregate page visits; see the privacy page for its data boundaries.
• Production and development dependencies are locked and audited by the verification gate.

CLI boundaries

• BM25 operates without network requests.
• Provider keys are read from local environment configuration and excluded from reports.
• HTML reports escape dataset content and include only a static theme-switching script and no remote assets.
• Remote provider use is explicit and can transmit source text and questions.

Report a vulnerability

For CLI vulnerabilities, use private vulnerability reporting, or email midaghdour@gmail.com with the affected version, impact, reproduction steps, and a safe proof of concept. Do not include active credentials or confidential third-party data.

Please allow a reasonable period to investigate before public disclosure. This page does not authorize testing that degrades service, accesses another person’s data, violates law, or targets third-party infrastructure.

Supported release

The current supported CLI release is 0.2.1. Upgrade before reporting a problem already resolved in a newer release.