Please email security@xalgorix.com with details. We acknowledge reports within two business days and aim to ship a fix or mitigation on a severity-driven schedule. Do not file public GitHub issues for suspected vulnerabilities.

The scanner dashboard is a single-operator administration interface. All sessions authenticated with its configured operator credentials have the same permissions over scans and provider settings. Session tokens are not separate user or tenant identities. Do not give these credentials to mutually untrusted users or expose this API as a tenant-facing service. A hosted integration must authenticate its own users and enforce scan ownership before accessing the scanner through server-held credentials.

LLM provider URLs are trusted operator configuration. Private endpoints are supported for local Ollama and OpenAI-compatible gateways. Configure endpoints you trust to receive scan context and provider credentials; tenant-facing applications must not forward customer-supplied provider URLs or credentials.

Web report logos must be uploaded through the dashboard. Logo references are limited to the configured logos directory; arbitrary local image paths and scan-directory relative paths are not accepted. Saved absolute paths within the upload directory remain supported. Re-upload older external logos to use them in web reports.

The security-daily GitHub Actions workflow runs every day at 07:00 UTC (and on workflow_dispatch). It executes govulncheck ./... against the Go module. When it reports a vulnerability the project actually calls into, the run fails and a GitHub Issue labelled security and automated is opened with the report attached as a workflow artifact. The job skips (and logs a notice) if go.mod is absent, so the schedule keeps running regardless.