🔒 Security Policy — LeadIQ-AI

LeadIQ-AI takes security, secret isolation, and data privacy seriously.

1. Secret & Credential Isolation

No Hardcoded Secrets: No API keys, database passwords, Slack tokens, service role keys, or OAuth credentials are saved in repository source code or workflow JSON files.
Environment Management: Environment configuration is managed strictly via .env files. .env is listed in .gitignore and is never committed to Git.
Placeholder Values: All example files (.env.example, documentation, cURL scripts) strictly utilize placeholder strings (your_gemini_api_key_here, your_supabase_url_here).

Gemini API Key: Rotate your Google Gemini API key every 90 days.
Supabase Service Role Key: Treat SUPABASE_SERVICE_ROLE_KEY as a root credential. Never expose it to public client applications or web browsers.
Slack Tokens: Regenerate Slack OAuth bot tokens immediately if suspicious activity is detected.

If you discover a potential security vulnerability within LeadIQ-AI, please report it responsibly:

Do NOT open a public GitHub issue.
Send a detailed report outlining the issue, steps to reproduce, and potential impact to the project maintainers via email or private channel.
The maintainers will investigate and publish a resolution promptly.