RepoMind is at an early stage. Security fixes are applied to the latest release.

Please do not open a public issue for security vulnerabilities.

Instead, report privately using GitHub's Report a vulnerability flow (Security → Advisories). Include:

• a description of the issue and its impact,
• steps to reproduce (a minimal example if possible),
• affected version/commit,
• any suggested remediation.

We aim to acknowledge reports within a few days and will keep you informed as we investigate and prepare a fix. Please allow reasonable time to remediate before any public disclosure.

RepoMind is designed to be safe by default:

• Runs locally. The dashboard binds to 127.0.0.1 by default. If you change --host, you expose the server on your network — only do so on trusted networks.
• No telemetry. Nothing is sent anywhere unless you explicitly configure OpenRouter (OPENROUTER_API_KEY). When configured, questions plus relevant code snippets are sent to OpenRouter to generate answers.
• Secrets stay local. .env is git‑ignored; only .env.example is tracked. Never commit real API keys.
• Untrusted repositories. Analysis parses files as text/AST and does not execute analyzed code. Still, treat generated output from unknown repositories with normal caution.

RepoMind has zero third‑party dependencies and requires no external services for its core functionality, which keeps its supply‑chain surface minimal.