SECURITY.md

Security Policy

Supported versions

qalmsw is pre-1.0. Security fixes are applied to the main branch until formal releases are published.

Reporting a vulnerability

Please do not open a public issue for a vulnerability.

Report security-sensitive problems by emailing the maintainer listed on the GitHub repository profile, or by opening a private GitHub security advisory if that is enabled for the repository.

Useful details include:

• A minimal input file or command that triggers the issue.
• Whether the issue requires network retrieval or an LLM server.
• Any file paths, URLs, or environment variables involved.

Security model

qalmsw reads LaTeX and BibTeX files supplied by the user and may call local LLM and metadata retrieval services. It should not execute LaTeX, shell commands from input, or arbitrary code embedded in a manuscript.

The default LLM endpoint is a local llama.cpp server. Users who configure another OpenAI-compatible endpoint are responsible for that provider's data handling terms.