Please do not open a public issue for security problems.

Report privately via GitHub's Report a vulnerability button (the repo's Security tab, then Advisories). If you can't use that, email security@openmagpie.ai instead.

We aim to acknowledge within 3 business days and will keep you updated as we investigate. Once a fix ships we're glad to credit you, unless you'd rather stay anonymous.

OpenMagpie is self-hosted and BYO-LLM: relevance judgements run against a model you operate. The areas we care most about:

• The connector fetch path (untrusted source URLs) and its SSRF containment.
• Authentication and account-scoping in apps/core (auth_api, accounts).
• The webhook delivery path and any handling of secrets.

Pre-1.0: fixes land on main. Pin a commit if you need stability.