If you find a security issue in this project, please do not open a public issue. Use GitHub's private vulnerability reporting on this repository (Security tab, then "Report a vulnerability"). You will get a response within a week. Please include reproduction steps and the affected version.

This project is built around one rule: the API key exists only in your environment.

• The key is read from the GEMINI_API_KEY environment variable, usually via a local .env file that is gitignored.
• The key is held in memory as a Pydantic SecretStr, so it never appears in logs, tracebacks, or repr output.
• The doctor command prints only a masked form of the key.
• Nothing in this repository ever writes the key to disk.

If your key is ever exposed (committed, pasted into a chat or issue, shared in a screenshot), revoke it and create a new one at https://aistudio.google.com/apikey. Assume any exposed key is compromised.

The main adversary is a user (or a copy-pasted text) that tries to make the assistant ignore its instructions: answer off-topic questions, reveal the system prompt, or adopt a new persona. The project defends with five layers: input sanitization, an injection signature scanner, an optional scope pre-check on a second model, a hardened system prompt with randomized delimiters and a canary token, and an output guard that suppresses leaked security material. Details live in docs/security-model.md.

The web UI adds an internet-facing surface, defended in its own layers: the replayed conversation history is treated as untrusted and passes the same input guards as live questions, visitors are rate limited per IP, models are restricted to a server-side allowlist, internal errors are never shown to the browser, and every page ships strict security headers including a same-origin Content Security Policy. See the web threats section of docs/security-model.md and the invariants at the end of docs/deployment.md.

Prompt injection cannot be prevented with certainty by any known technique. The layers here raise the cost of an attack significantly and detect the most damaging outcomes (prompt leakage), but a sufficiently creative attacker may still elicit off-topic responses. Do not put anything in your profile context that would be harmful if repeated back verbatim, and never put secrets in it.