# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| >= 3.3  | :white_check_mark: |
| < 3.3   | :x:                |

## Reporting a Vulnerability

LexRAG is a legal research tool designed for professional use. Security is a top priority.

**Please do not report security vulnerabilities through public GitHub issues.**

Instead, report them directly to:

- **Email**: security@eulogik.com
- **PGP Key**: Available on request

### What to include

- Type of vulnerability
- Steps to reproduce
- Affected versions
- Potential impact
- Suggested fix (if any)

### What to expect

- **Acknowledgment** within 48 hours
- **Status update** within 5 business days
- **Fix timeline** communicated within 10 business days

## Best Practices for Deployment

1. **API Keys**: Never commit `.env` to version control. Use environment variables or a secrets manager.
2. **Network**: Run the server behind a reverse proxy (nginx, Caddy) with TLS in production.
3. **Authentication**: Add API key authentication for production deployments (see `LEXRAG_API_KEY`).
4. **Database**: Regularly backup `data/lexrag.db` and `qdrant_storage/`.
5. **Updates**: Keep dependencies updated: `pip install --upgrade -r requirements.txt`

## Hallucination & Accuracy Disclaimer

LexRAG uses Retrieval-Augmented Generation (RAG) to ground answers in legal documents. However:
- AI models may still produce inaccurate or incomplete responses
- Always verify AI-generated legal analysis against primary sources
- LexRAG is a research assistance tool, not a substitute for qualified legal counsel

## Responsible Disclosure

We believe in responsible disclosure. If you discover a vulnerability, please give us a reasonable time to fix it before public disclosure.