DevIntel AI takes security vulnerabilities seriously. We appreciate your efforts to responsibly disclose any security issues.

Only the latest stable release of DevIntel AI receives security updates.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report vulnerabilities privately by emailing the maintainers or filing a confidential GitHub Security Advisory:

1. Email: security@devintel.ai (or contact maintainer via GitHub profile)
2. Include steps to reproduce the vulnerability, proof-of-concept code, and impacted components.

• We will acknowledge receipt of your vulnerability report within 24 hours.
• We will provide an estimated timeframe for addressing the vulnerability.
• We will notify you once the fix has been deployed and released.

• Secret Masking: Secret keys (sk_live_..., GEMINI_API_KEY) are stored in local environment variables and never logged or exposed in client bundles.
• Tenant Isolation: Vector store indices partition documents by project_id to prevent cross-tenant data leaks.
• Rate Limiting & Quotas: Built-in SaaS API Key Quota Manager enforces daily request boundaries (Free, Pro, Enterprise).