Please do NOT report security vulnerabilities through public GitHub issues.

Instead, please report them via email to: security@gelutjari.com

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

• Initial response: Within 48 hours
• Triage: Within 1 week
• Fix development: Within 30 days
• Public disclosure: After fix is released (90-day policy)

We consider security research conducted in accordance with this policy as:

• Authorized and will not pursue legal action
• Exempt from DMCA and CFAA restrictions
• Conducted in good faith

• Bearer token authentication for REST API
• JWT token support for session management
• Constant-time token comparison (prevents timing attacks)

• Path traversal prevention (canonicalization, symlink checks)
• SQL injection prevention (parameterized queries)
• XSS prevention (output encoding)

• CORS whitelist configuration
• Rate limiting (10 requests/second per IP)
• Localhost-only binding by default

• SQLite WAL mode for data integrity
• Blake3 hashing for file integrity
• No external network calls (100% local)

We kindly ask that you:

1. Give us reasonable time to fix the issue before public disclosure
2. Avoid accessing or modifying other users' data
3. Avoid actions that negatively impact other users

We recognize security researchers who help improve AIKD:

• Security issues: security@gelutjari.com
• General questions: GitHub Discussions
• Bug reports: GitHub Issues