This project is designed with security in mind:

• No External API Keys: All services run locally (Ollama, ChromaDB)
• No Network Dependencies: Pipeline runs entirely offline after initial setup
• No Sensitive Data Storage: User data is processed locally only
• Local LLM Only: Uses Ollama on localhost:11434 (no cloud LLM calls)

If you discover a security vulnerability, please:

1. Do NOT open a public GitHub issue
2. Email the maintainer directly with details
3. Allow 48 hours for initial response
4. Provide steps to reproduce if possible

All dependencies are open-source and regularly maintained:

• See requirements.txt for the complete list
• Run pip audit to check for known vulnerabilities