Please do not open public issues for security vulnerabilities. Email security@repograph.dev or open a private security advisory on GitHub.

We aim to respond within 48h and fix critical issues within 7 days.

• No auth for first public graph — soft-gate 3/day/IP + Turnstile; do not trust IP alone.
• GitHub credentials — never exposed to browser, never logged, isolated per ingestion job.
• Rate limits — token pool with Retry-After honor; abuse triggers 429 + queue.
• Content — repository-generated HTML sanitized; markdown rendered with allowlist.
• Private repos — future GitHub App requires minimum read-only permissions; webhook signatures validated (see apps/api/src/github).

• Cloudflare in front (WAF + bot, Turnstile)
• REDIS_URL + DATABASE_URL via secrets manager, not .env
• Prisma parameterized queries only (no raw SQL from user input)
• Validate POST /repositories/resolve URL strictly to github.com
• Rate-limit graph queries per IP + per repo dedup