Only the latest release is actively supported with security fixes.

Please do not open a public GitHub Issue for security vulnerabilities.

Report security issues privately via one of the following channels:

• GitHub Private Security Advisory: Use the Security tab → Report a vulnerability form in this repository.
• Email: Send details to github@mail.hunsakerweb.com with the subject line [Folge_Accessibility SECURITY] <short description>.

A useful report includes:

1. A description of the vulnerability and its potential impact.
2. Steps to reproduce or a minimal proof-of-concept.
3. The version(s) affected.
4. Any suggested mitigations or patches, if known.

If a fix will take longer than 30 days we will notify you and agree on a coordinated disclosure date.

This project is a documentation publishing pipeline that processes guide exports and generates accessible output formats. The security boundary is:

• In scope: vulnerabilities in the Python application code (src/folge_cli/), dependency chain, configuration handling, and API key management.
• Out of scope: vulnerabilities in external tools (Pandoc, Ollama, vision model servers), the host operating system, or user-supplied guide data.

API keys for cloud providers (OpenRouter, OpenAI, Gemini, Anthropic) are stored in .env which is .gitignored. Never commit API keys to the repository.

Best practices:

• Use .env for all secrets — never hardcode keys in source files.
• Add .env to .gitignore (already configured).
• Use environment-specific keys for development vs. production.
• Rotate keys regularly.

Dependencies are tracked in pyproject.toml. To audit the installed environment for known CVEs run:

uv run pip-audit

We follow the GitHub coordinated vulnerability disclosure guidelines.