docs: add SECURITY.md

Directs vulnerability reports to the contact form at oai.pm instead of
public issues.

.env.example

@@ -10,7 +10,7 @@ DB_MASTER_PASSWORD=change-me-to-a-strong-passphrase
 PORT=8080
 
 # Default model pre-selected in chat UI (leave empty to use the first available model)
-# DEFAULT_CHAT_MODEL=claude-sonnet-4-6
+# DEFAULT_CHAT_MODEL=claude-sonnet-5
 
 # Main app database — PostgreSQL (shared postgres service)
 AIDE_DB_URL=postgresql://aide:change-me@postgres:5432/aide

SECURITY.md

@@ -0,0 +1,28 @@
+# Security Policy
+
+oAI-Web is a self-hosted personal agent that can read your email, calendar, and files, and take real actions on your behalf. We take security issues seriously and appreciate responsible disclosure.
+
+## Reporting a Vulnerability
+
+**Please do not open a public GitLab/GitHub issue for security vulnerabilities.**
+
+Instead, report it privately through the contact form at:
+
+**[https://oai.pm/#contact](https://oai.pm/#contact)**
+
+Include as much detail as you can:
+
+- A description of the vulnerability and its potential impact
+- Steps to reproduce (proof-of-concept code or requests, if applicable)
+- The affected version/commit
+- Any suggested mitigation, if you have one
+
+You should receive an acknowledgement of your report. We'll keep you updated as the issue is investigated and fixed, and we're happy to credit you in the release notes once a fix ships, if you'd like.
+
+## Scope
+
+This policy covers the oAI-Web server, its tools, and the web interface in this repository. It does not cover third-party services you configure (e.g. your AI provider, mail server, or CalDAV host) - please report issues in those directly to their maintainers.
+
+## Supported Versions
+
+Only the latest release on the `main` branch is actively supported with security fixes. If you're running an older version, please upgrade before reporting an issue, as it may already be resolved.

server/agent_templates.py

@@ -82,7 +82,7 @@ TEMPLATES: list[dict] = [
         "suggested_schedule": "",
         "suggested_tools": ["web"],
         "prompt_mode": "combined",
-        "model": "claude-sonnet-4-6",
+        "model": "claude-sonnet-5",
     },
     {
         "id": "download-stats",

server/providers/anthropic_provider.py

@@ -16,7 +16,7 @@ from .base import AIProvider, ProviderResponse, ToolCallResult, UsageStats
 
 logger = logging.getLogger(__name__)
 
-DEFAULT_MODEL = "claude-sonnet-4-6"
+DEFAULT_MODEL = "claude-sonnet-5"
 
 
 class AnthropicProvider(AIProvider):

server/providers/models.py

@@ -17,30 +17,42 @@ logger = logging.getLogger(__name__)
 
 # Current Anthropic models (update when new ones ship)
 _ANTHROPIC_MODELS = [
-    "anthropic:claude-opus-4-6",
-    "anthropic:claude-sonnet-4-6",
+    "anthropic:claude-fable-5",
+    "anthropic:claude-opus-4-8",
+    "anthropic:claude-sonnet-5",
     "anthropic:claude-haiku-4-5-20251001",
 ]
 
 _ANTHROPIC_MODEL_INFO = [
     {
-        "id": "anthropic:claude-opus-4-6",
+        "id": "anthropic:claude-fable-5",
         "provider": "anthropic",
-        "bare_id": "claude-opus-4-6",
-        "name": "Claude Opus 4.6",
-        "context_length": 200000,
-        "description": "Anthropic's most powerful model. Best for complex reasoning, nuanced writing, and sophisticated analysis.",
+        "bare_id": "claude-fable-5",
+        "name": "Claude Fable 5",
+        "context_length": 1000000,
+        "description": "Anthropic's most capable widely-released model. Best for the most demanding reasoning and long-horizon agentic work.",
         "capabilities": {"vision": True, "tools": True, "online": False, "image_gen": False},
-        "pricing": {"prompt_per_1m": 15.00, "completion_per_1m": 75.00},
+        "pricing": {"prompt_per_1m": 10.00, "completion_per_1m": 50.00},
         "architecture": {"tokenizer": "claude", "modality": "text+image->text"},
     },
     {
-        "id": "anthropic:claude-sonnet-4-6",
+        "id": "anthropic:claude-opus-4-8",
         "provider": "anthropic",
-        "bare_id": "claude-sonnet-4-6",
-        "name": "Claude Sonnet 4.6",
-        "context_length": 200000,
-        "description": "Best balance of speed and intelligence. Ideal for most tasks requiring strong reasoning with faster response times.",
+        "bare_id": "claude-opus-4-8",
+        "name": "Claude Opus 4.8",
+        "context_length": 1000000,
+        "description": "Anthropic's most capable Opus-tier model. Best for complex reasoning, nuanced writing, and sophisticated analysis.",
+        "capabilities": {"vision": True, "tools": True, "online": False, "image_gen": False},
+        "pricing": {"prompt_per_1m": 5.00, "completion_per_1m": 25.00},
+        "architecture": {"tokenizer": "claude", "modality": "text+image->text"},
+    },
+    {
+        "id": "anthropic:claude-sonnet-5",
+        "provider": "anthropic",
+        "bare_id": "claude-sonnet-5",
+        "name": "Claude Sonnet 5",
+        "context_length": 1000000,
+        "description": "Best balance of speed and intelligence. Near-Opus quality on coding and agentic work at Sonnet cost.",
         "capabilities": {"vision": True, "tools": True, "online": False, "image_gen": False},
         "pricing": {"prompt_per_1m": 3.00, "completion_per_1m": 15.00},
         "architecture": {"tokenizer": "claude", "modality": "text+image->text"},
@@ -53,7 +65,7 @@ _ANTHROPIC_MODEL_INFO = [
         "context_length": 200000,
         "description": "Fastest and most compact Claude model. Great for quick tasks, simple Q&A, and high-throughput workloads.",
         "capabilities": {"vision": True, "tools": True, "online": False, "image_gen": False},
-        "pricing": {"prompt_per_1m": 0.80, "completion_per_1m": 4.00},
+        "pricing": {"prompt_per_1m": 1.00, "completion_per_1m": 5.00},
         "architecture": {"tokenizer": "claude", "modality": "text+image->text"},
     },
 ]
@@ -380,8 +392,8 @@ def get_model_pricing(model_id: str) -> tuple[float | None, float | None]:
     Returns (None, None) if pricing is unknown for this model.
 
     Handles multiple formats:
-      "anthropic:claude-sonnet-4-6"  — prefixed (canonical)
-      "claude-sonnet-4-6"            — bare Anthropic ID (stored by Anthropic provider)
+      "anthropic:claude-sonnet-5"  — prefixed (canonical)
+      "claude-sonnet-5"            — bare Anthropic ID (stored by Anthropic provider)
       "openrouter:openai/gpt-4o"     — prefixed OpenRouter ID
       "openai/gpt-4o"                — bare OpenRouter ID (stored by some agents)
       "openai:gpt-4o"                — prefixed OpenAI ID

server/providers/registry.py

@@ -69,9 +69,9 @@ async def get_provider_for_model(model_str: str, user_id: str | None = None) ->
 
     If the model string has no provider prefix, the default provider is used.
     Examples:
-      "anthropic:claude-sonnet-4-6"  → (AnthropicProvider, "claude-sonnet-4-6")
+      "anthropic:claude-sonnet-5"  → (AnthropicProvider, "claude-sonnet-5")
       "openrouter:openai/gpt-4o"     → (OpenRouterProvider, "openai/gpt-4o")
-      "claude-sonnet-4-6"            → (default_provider,   "claude-sonnet-4-6")
+      "claude-sonnet-5"            → (default_provider,   "claude-sonnet-5")
     """
     _known = {"anthropic", "openrouter", "openai"}
     if ":" in model_str: