If you discover a security vulnerability in this project, please report it privately. Do not disclose it publicly until we have had a chance to address it.

To report a vulnerability, please open a GitHub Security Advisory at: https://github.com/DogStark/aiEdu/security/advisories/new

Alternatively, you can email the maintainers directly (see the repository's .github/CODEOWNERS or recent commit authors for contact information).

We will acknowledge receipt within 48 hours and provide an estimated timeline for a fix.

This security policy covers:

• The AI agent API (main.py and api/ directory)
• Student profile data storage and handling
• Authentication and consent mechanisms
• Dependencies and third-party integrations

• Always run the service with ENV=production in production deployments
• Configure CORS_ALLOW_ORIGINS to the specific origins that need access
• Keep dependencies up to date
• Review and rotate any secrets or API keys regularly

CI runs pip-audit against requirements.txt/requirements-dev.txt on every push and pull request, and scans the diff for committed secrets with TruffleHog. Both are required checks: an undocumented finding fails the build.

pip-audit's CI step explicitly ignores the findings below via --ignore-vuln. Each is deferred rather than silently allowed because fixing it means bumping a framework across a range that needs its own compatibility testing, not a tooling-only change:

Adding a new --ignore-vuln entry to .github/workflows/ci.yml without adding a row here (with a reason) is not acceptable — the CI step's own comment says so. Track the upgrades above in a follow-up issue rather than resolving them as a side effect of unrelated work.