The main branch and the latest tagged release receive security fixes.

Please report security issues privately by opening a GitHub Security Advisory rather than a public issue. Include reproduction steps and the affected version. You can expect an initial acknowledgement within a few days.

• Never commit API tokens or model credentials. Use .env (git-ignored) and the RAG_* environment variables documented in .env.example.
• The HUGGING_FACE_HUB_TOKEN used for gated models (e.g. Llama-3) should be provided at runtime, not baked into images.