Only the latest version on the main branch is currently supported with security updates.

We take security seriously. If you discover a security vulnerability within FridgeAI, please do not open a public issue.

Instead, send a detailed report to [INSERT SECURITY EMAIL].

Please include:

• A clear description of the vulnerability
• Steps to reproduce the issue
• Affected versions/components
• Any potential mitigations you've identified

You should receive a response within 48 hours. If the issue is confirmed, we will release a patch as soon as possible depending on complexity.

This project connects to IoT hardware and external APIs. When deploying:

• API Keys: Never commit .env files or hardcode credentials
• Network: Run behind a reverse proxy (nginx/Caddy) with HTTPS
• Neo4j & Milvus: Secure with strong passwords and restrict to localhost when possible
• OneNET MQTT: Use device-level authentication tokens, not master keys
• WebSocket: The /ws/chat endpoint does not implement authentication - use a reverse proxy to add auth layer in production

See Known Limitations in the README for currently documented security-relevant limitations.