SECURITY.md

Security Policy

Supported Versions

Version	Supported
>= 3.3	:white_check_mark:
< 3.3	:x:

Reporting a Vulnerability

LexRAG is a legal research tool designed for professional use. Security is a top priority.

Please do not report security vulnerabilities through public GitHub issues.

Instead, report them directly to:

• Email: security@eulogik.com
• PGP Key: Available on request

What to include

• Type of vulnerability
• Steps to reproduce
• Affected versions
• Potential impact
• Suggested fix (if any)

What to expect

• Acknowledgment within 48 hours
• Status update within 5 business days
• Fix timeline communicated within 10 business days

Best Practices for Deployment

1. API Keys: Never commit .env to version control. Use environment variables or a secrets manager.
2. Network: Run the server behind a reverse proxy (nginx, Caddy) with TLS in production.
3. Authentication: Add API key authentication for production deployments (see LEXRAG_API_KEY).
4. Database: Regularly backup data/lexrag.db and qdrant_storage/.
5. Updates: Keep dependencies updated: pip install --upgrade -r requirements.txt

Hallucination & Accuracy Disclaimer

LexRAG uses Retrieval-Augmented Generation (RAG) to ground answers in legal documents. However:

• AI models may still produce inaccurate or incomplete responses
• Always verify AI-generated legal analysis against primary sources
• LexRAG is a research assistance tool, not a substitute for qualified legal counsel

Responsible Disclosure

We believe in responsible disclosure. If you discover a vulnerability, please give us a reasonable time to fix it before public disclosure.