Skip to content

Security: wangchunyang888/CraftPPT

Security

SECURITY.md

Security policy

Supported versions

Version Supported
main / latest tag Yes

Reporting a vulnerability

Please do not open a public GitHub issue for security-sensitive reports.

  1. Email or DM repository maintainers (see GitHub org) with:
    • Description and impact
    • Steps to reproduce
    • Whether secrets or user data are involved
  2. We aim to acknowledge within 7 days and coordinate a fix before disclosure.

Secrets

  • Never commit API keys. Use CRAFTPPT_LLM_API_KEY or local appsettings.json (gitignored patterns in .gitignore).
  • If a key was committed, rotate it immediately and purge git history if the repo was public.

Scope

CraftPPT is a local CLI that calls LLM APIs you configure. You are responsible for network policy, data residency, and gateway authentication in your environment.

There aren't any published security advisories