Please do not open a public issue for security vulnerabilities.

Report privately instead:

• Open a private security advisory, or
• Email the maintainers (see the repository profile for contact).

You should receive a response within 7 days. Please include:

• Affected version(s) / commit
• Steps to reproduce
• Impact description

• The DeepSeek AI assistant stores the API key locally only (never sent to GitHub or any third party other than the configured AI provider).
• The AI assistant's run_command tool uses a whitelist and refuses destructive commands (rm, taskkill, wget, ...). Do not weaken this whitelist without review.
• Python backend code generated from the DSL runs in the local process tree; treat untrusted .nsdl files like untrusted code — review before running.

We appreciate responsible disclosure. Once a fix is released, we will acknowledge the reporter in the release notes (unless anonymity is requested).