We release patches for security vulnerabilities for the following versions:

We take security seriously. If you discover a security vulnerability, please follow these steps:

• Open a public GitHub issue
• Discuss the vulnerability publicly
• Exploit the vulnerability

1. Email us directly at vixues@gmail.com
2. Include the following information:
   • Type of vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Initial Assessment: Within 7 days
• Resolution Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 90 days

• We will credit you in the security advisory (unless you prefer anonymity)
• We may offer a bounty for significant findings

When deploying LeAgent, follow these guidelines:

Compulsory instance access password + JWT (see docs/technical/security-control-plane.md):

# Strong signing secret (required for Docker / LAN)
export LEAGENT_SECRET_KEY="$(openssl rand -hex 32)"

# Auto-enforced when binding non-loopback; force on/off explicitly if needed:
# export LEAGENT_SECURITY_ENFORCE_AUTH=true
# export LEAGENT_SECURITY_ENFORCE_AUTH=false

# First browser visit → /login setup screen, or:
curl -X POST http://127.0.0.1:7860/api/v1/auth/setup \
  -H 'Content-Type: application/json' \
  -d '{"password":"choose-a-strong-password","confirm_password":"choose-a-strong-password"}'

Named users (admin-only): GET/POST /api/v1/admin/users.

# docker-compose.yml
services:
  leagent:
    # Prefer localhost-only publish; use a reverse proxy for LAN/WAN
    ports:
      - "127.0.0.1:8000:8000"

When intentionally exposing the API on a LAN, keep LEAGENT_HOST=0.0.0.0, complete /auth/setup, and set explicit CORS origins:

export LEAGENT_SECURITY_CORS_ALLOW_ORIGINS="http://192.168.1.10:5173"
export LEAGENT_SECURITY_RATE_LIMIT_ENABLED=true

# Use strong passwords
DATABASE_URL: postgresql+asyncpg://user:STRONG_PASSWORD@postgres:5432/leagent

# Enable SSL in production
DATABASE_SSL: true

# Rate limiting
rate_limit:
  enabled: true
  requests_per_minute: 60
  burst: 10

# Content size limits
max_upload_size_mb: 50
max_request_size_mb: 10

# Never commit secrets
# Use environment variables or secret management

# Docker secrets
docker secret create jwt_secret ./jwt_secret.txt

# Kubernetes secrets
kubectl create secret generic leagent-secrets \
  --from-literal=jwt-secret=xxx \
  --from-literal=db-password=xxx

All security-relevant events are logged:

# Logged events
- User login/logout
- Failed authentication attempts
- Permission changes
- Data access
- Configuration changes
- API key creation/revocation

# Encryption at rest
encryption:
  enabled: true
  algorithm: AES-256-GCM
  key_rotation_days: 90

# Data retention
retention:
  audit_logs_days: 365
  chat_history_days: 90
  temp_files_hours: 24

1. Prompt Injection: User inputs are sanitized before LLM processing
2. Data Leakage: Sensitive data is masked in logs
3. Model Outputs: Generated content is validated before execution

1. SQL Injection: Parameterized queries only
2. Command Injection: Input validation on all tools
3. File Access: Sandboxed file operations

1. XSS: Content Security Policy headers
2. CSRF: Token-based protection
3. Clickjacking: X-Frame-Options header

• Change default admin password
• Set strong JWT secret
• Enable HTTPS/TLS
• Configure firewall rules
• Enable rate limiting
• Set up monitoring and alerting
• Configure backup encryption
• Review RBAC permissions
• Enable audit logging
• Schedule security updates

Subscribe to security announcements:

• GitHub Security Advisories
• Email notifications (vixues@gmail.com)

LeAgent is designed to support compliance with:

• GDPR (data protection)
• SOC 2 (security controls)
• ISO 27001 (information security)

Consult your compliance team for specific requirements.

• Security issues: vixues@gmail.com
• General questions: vixues@gmail.com
• PGP Key: [Available on request]