# Security Policy

Security is part of the release contract for yedir-ai. This project handles AI provider keys, OAuth credentials, object-storage URLs, user uploads, generated media, and internal generation workflows, so disclosures should be handled carefully and privately.

## Supported Versions

Security fixes are applied to the active `main` branch and release branches maintained by the project owner. Older experimental branches are not guaranteed to receive patches.

## Reporting a Vulnerability

Do not open a public issue for suspected vulnerabilities.

Report privately to the repository owner or project maintainer with:

- A short description of the issue and affected area.
- Reproduction steps or a minimal proof of concept.
- Potential impact, including whether secrets, user data, uploads, signed URLs, or internal APIs are exposed.
- Relevant logs with secrets, cookies, Authorization headers, OAuth codes, signed URLs, prompts, base64 data, and private user content removed.

Expected handling:

- The maintainer will acknowledge the report when it is received.
- Valid issues will be triaged by impact and exploitability.
- Fixes should include regression coverage or a documented verification path where practical.
- Public disclosure should wait until a fix or mitigation is available.

## Sensitive Data Rules

Never commit or paste:

- `.env.local` or real environment variables.
- API keys, OAuth client secrets, OAuth codes, cookies, session tokens, Authorization headers, or passwords.
- Signed object-storage URLs, raw upload URLs, private bucket paths, or third-party task payloads.
- Full prompts, base64 image/video data, or private generated media unless explicitly sanitized.

Use `.env.example` for placeholders only.

## Logging Rules

High-risk server logs should use `createLogger` from `lib/observability/logger`. Browser logs should use `createClientLogger` and stay silent in production unless explicitly enabled.

Before merging security-sensitive changes, run:

```bash
pnpm check:quality
pnpm audit:security
```

For route-level release smoke tests, also run:

```bash
AUTH_TRUST_HOST=true PORT=3001 pnpm dev
SMOKE_BASE_URL=http://127.0.0.1:3001 pnpm smoke:routes
```

If a file starts logging prompts, URLs, provider responses, upload details, OAuth data, or user content, add it to `scripts/check-log-hygiene.mjs` and ensure `pnpm check:logs` passes.

Dependency audit risk is tracked in `docs/dependency-risk-register.md`. Critical/high advisories in runtime dependencies should be remediated or explicitly accepted before production release.

## Deployment Security Notes

- Configure `AUTH_SECRET` and production `AUTH_URL`.
- Use `AUTH_TRUST_HOST=true` only behind a trusted reverse proxy with validated Host headers.
- Keep database, storage, OAuth, and AI provider credentials in the deployment secret store.
- Prefer short database connect timeouts and bounded connection pools.
- Verify `/settings` remains protected and redirects unauthenticated users to login.

See also:

- `docs/deployment.md`
- `docs/operations.md`
- `docs/release-readiness.md`