RepoRadar is designed as a local-first, no-login app.

Do not commit .env, .env.local, API keys, access tokens, local databases, or generated caches.

Optional keys are read from local environment variables only:

• GITHUB_TOKEN
• ANTHROPIC_API_KEY
• ANTHROPIC_MODEL

The app does not ask users to paste secrets into the browser UI.

GitHub repository metadata is untrusted data. RepoRadar must not execute fetched code, clone arbitrary repositories in the MVP, or treat repository text as instructions.

AI summaries are optional and must be treated as fallible. The app validates structured output and falls back to deterministic summaries when needed.

If this repository is public and you find a security issue, open a private security advisory on GitHub if available, or contact the maintainer through the channel listed on the public repository profile.