If you discover a security vulnerability in contextkit, please report it privately:

📧 contextkit-security@example.com

Please do not open a public GitHub issue for security vulnerabilities.

We will:

• Acknowledge your report within 48 hours
• Provide an initial assessment within 7 days
• Keep you informed of our progress

• ✅ Reads source code files from the local filesystem
• ✅ Optionally sends codebase context to Anthropic API (if ANTHROPIC_API_KEY is set)
• ✅ Writes generated files to .ai-context/ directory

• ❌ Does not upload your code anywhere (unless you explicitly set the LLM API key)
• ❌ Does not execute any code
• ❌ Does not modify your source files (only creates files in output directory)
• ❌ Does not make network requests except for optional LLM analysis

When you set ANTHROPIC_API_KEY, contextkit will send a summary of your codebase to the Anthropic API to extract additional coding rules.

If you have privacy concerns, use the --no-llm flag to disable this:

contextkit init . --no-llm

This will only use local heuristic analysis (regex, AST parsing, config detection).

1. For sensitive codebases: Use --no-llm to keep everything local
2. For CI/CD: Don't set ANTHROPIC_API_KEY unless needed
3. For shared filesystems: contextkit respects .gitignore and skips common build directories
4. For monorepos: Run contextkit in subdirectories to control what's included