Please do not open a public GitHub issue for security vulnerabilities.

Instead, report it privately through GitHub's private vulnerability reporting (the Security tab → "Report a vulnerability"). This keeps the details confidential until a fix is available.

When reporting, please include:

• A description of the issue and its potential impact.
• Steps to reproduce (affected provider/client, request shape, config).
• Any suggested remediation, if you have one.

You can expect an initial acknowledgement within a few days. Please give a reasonable window for a fix before any public disclosure.

CrewForge is a local proxy: it forwards Claude Code / Codex traffic to upstream model providers using API keys you supply. Keep the following in mind:

• Your API keys live in .env and local config. They are never committed — .env is git-ignored and .env.example ships with empty values.
• The Admin UI and proxy bind locally. Do not expose the proxy port to an untrusted network without your own authentication in front of it.
• Crew Mode redacts likely secrets from internal output via core.crew.safety.redact_secrets before it reaches transcripts/logs. If you find a secret format that slips through, that is a security issue worth reporting.

This project tracks main. Fixes land on main; please test against the latest commit before reporting.