oai-web/SECURITY.md

Security Policy

oAI-Web is a self-hosted personal agent that can read your email, calendar, and files, and take real actions on your behalf. We take security issues seriously and appreciate responsible disclosure.

Reporting a Vulnerability

Please do not open a public GitLab/GitHub issue for security vulnerabilities.

Instead, report it privately through the contact form at:

https://oai.pm/#contact

Include as much detail as you can:

• A description of the vulnerability and its potential impact
• Steps to reproduce (proof-of-concept code or requests, if applicable)
• The affected version/commit
• Any suggested mitigation, if you have one

You should receive an acknowledgement of your report. We'll keep you updated as the issue is investigated and fixed, and we're happy to credit you in the release notes once a fix ships, if you'd like.

Scope

This policy covers the oAI-Web server, its tools, and the web interface in this repository. It does not cover third-party services you configure (e.g. your AI provider, mail server, or CalDAV host) - please report issues in those directly to their maintainers.

Supported Versions

Only the latest release on the main branch is actively supported with security fixes. If you're running an older version, please upgrade before reporting an issue, as it may already be resolved.