Security fixes target the default branch and the latest released version. Older versions may not receive separate backports.
Use the repository's GitHub Private vulnerability reporting feature. Do not open a public issue for a suspected vulnerability.
Include as much of the following information as possible:
- Affected version and platform
- Reproduction steps or a minimal proof of concept
- Potential impact
- Suggested remediation or mitigation, if available
Do not disclose vulnerability details publicly before the maintainers have confirmed and addressed the issue. Never include real API keys, personal data, or unrelated private project files in a report.
AutoCode does not bundle model credentials. API keys should only be written to the user
configuration directory through the TUI /model command. Never commit .autocode/,
autocode.md, .env, user configuration files, or any other credential-bearing file.