Security fixes are applied to the latest main branch while the project is pre-1.0.

Do not open a public issue for a suspected vulnerability or exposed secret. Use GitHub's private vulnerability reporting feature for this repository if available, or contact the repository owner privately through GitHub.

Include:

• a concise description;
• affected endpoint or component;
• reproduction steps or proof of concept;
• potential impact;
• suggested mitigation if known.

ContextVault is an early local-first technical project. It does not yet provide authentication, tenant isolation, encrypted object storage, malware scanning, or production-grade secret management. Do not upload confidential documents to a publicly exposed deployment.