Security fixes are applied to the actively developed branches of this repository (canary and the current master release line). Self-hosted deployments should stay up to date with the latest released changes.
If you discover a security vulnerability, please report it privately to:
Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.
- Description of the issue and impact
- Steps to reproduce or a proof of concept (if available)
- Affected component (e.g. auth, API, chat tools, billing)
- Your preferred contact method for follow-up
We will acknowledge the report as soon as possible, investigate, and work with you on a fix and coordinated disclosure when appropriate.
Thank you for helping keep Deni AI and its users safe.
In scope examples:
- Authentication / session issues
- Authorization bypasses (user, team, shared chat data)
- Injection, XSS, SSRF (including chat tools that fetch remote URLs)
- Secrets exposure or unsafe handling of BYOK keys
- Billing or usage-quota bypasses
Out of scope examples (unless they lead to a real vulnerability):
- Denial of service via volumetric traffic alone
- Issues that require physical access or already-compromised user credentials
- Reports based solely on missing non-security headers without impact