We release patches for security vulnerabilities in the following versions:

As an actively developed project, we support the current version and one prior minor version with security updates.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report security vulnerabilities by emailing:

security@aelira.ai

You should receive a response within 48 hours. If you don't hear back, please follow up to ensure we received your original message.

Please include the following information in your report:

• Type of vulnerability (e.g., SQL injection, XSS, authentication bypass)
• Location - Full paths of source file(s) related to the issue
• Configuration - Any special configuration required to reproduce
• Steps to reproduce - Step-by-step instructions
• Proof of concept - Code or screenshots if possible
• Impact - How an attacker could exploit this vulnerability
• Suggested fix (optional) - If you have ideas on how to fix it

1. Acknowledgment - We'll acknowledge receipt within 48 hours
2. Assessment - We'll assess the severity and impact within 7 days
3. Updates - We'll keep you informed of our progress
4. Resolution - We aim to resolve critical issues within 30 days
5. Credit - We'll credit you in our release notes (unless you prefer anonymity)

• Critical vulnerabilities: Patched within 7 days, disclosure after 30 days
• High severity: Patched within 14 days, disclosure after 60 days
• Medium/Low severity: Patched within 30 days, disclosure after 90 days

We follow responsible disclosure practices. Please do not publicly disclose the vulnerability until we've had a chance to address it.

• Dependency scanning - Automated via Dependabot
• Code scanning - GitHub CodeQL analysis on all PRs
• Secret scanning - Gitleaks prevents credential commits
• Input validation - Pydantic models validate all API inputs
• SQL injection prevention - SQLAlchemy ORM (no raw queries)
• Authentication - API keys with bcrypt hashing
• Rate limiting - Redis-based per-key limits

If you self-host Aelira, please ensure:

1. Use HTTPS - Never expose the API over plain HTTP
2. Firewall rules - Restrict access to necessary ports only
3. Database security - Use strong passwords, restrict network access
4. Keep updated - Apply security patches promptly
5. Monitor logs - Watch for unusual activity

• No external AI calls - All AI processing uses local Ollama
• No user tracking - We don't collect analytics on self-hosted instances
• Minimal data storage - Scan results are stored only for your access
• No credential storage - We never store your passwords (bcrypt hashes only)

• PDF processing - Uses Tesseract OCR; ensure PDFs are from trusted sources
• PowerPoint processing - Uses python-pptx; macro execution is disabled
• File uploads - Size limits enforced; validate file types before processing

• Local execution - All AI inference runs locally via Ollama
• Model integrity - Download models only from official Ollama sources
• Prompt injection - Input sanitization applied to AI prompts

We don't currently have a formal bug bounty program, but we deeply appreciate security researchers who help us improve. Depending on the severity and impact of the vulnerability, we may offer:

• Public acknowledgment (with your permission)
• Aelira swag/merchandise
• Extended trial of premium features

• Security issues: security@aelira.ai
• General questions: hello@aelira.ai
• Code of Conduct: conduct@aelira.ai

Thank you to all security researchers who have helped improve Aelira's security:

No vulnerabilities have been reported yet.

Last updated: November 2025