We take the security of Socheli and its users seriously.
Please do not open a public issue for security reports. Instead, email contact@socheli.com with:
- a description of the issue and its impact,
- steps to reproduce (proof-of-concept if possible),
- the affected package(s) and version(s).
You'll receive an acknowledgement within 72 hours, and we'll keep you updated as we investigate and ship a fix. We're happy to credit reporters who want it.
These public packages: @socheli/sdk,
@socheli/cli,
@socheli/mcp,
@socheli/api.
Every Socheli surface authenticates with a single Bearer API key
(SOCHELI_API_KEY). Treat it like a password: keep it server-side, never commit
it, never ship it to a browser or mobile bundle, and rotate it if exposed.