Please do not open a public issue for security problems.

Use GitHub's private reporting (Security → Report a vulnerability) on this repository. Include a description, reproduction steps, and the affected version. We aim to acknowledge within 7 days.

Be aware of the following before pointing ArchAgent at sensitive material:

1. Paper text is sent to a third-party model provider. Whatever you pass to analyze is transmitted to whichever base_url you configured. If you are working with unpublished excavation reports, use a local backend (Ollama or any self-hosted OpenAI-compatible server) — the model layer is provider-agnostic for exactly this reason.
2. API keys are read from environment variables, never from committed files. config.yaml is gitignored; config.example.yaml contains no secrets. Never paste a key into an issue or a gold annotation.
3. The web server is unauthenticated by default. archagent serve binds 127.0.0.1 and is intended for local use. If you expose it, set ARCHAGENT_TOKEN — the mutating endpoints (/api/analyze, /api/demo) then require an X-ArchAgent-Token header. There is no rate limiting; put a reverse proxy in front of anything public.
4. File upload accepts PDF/TXT and shells out to pdftotext. Uploads land in a temp directory and are parsed, not executed, but treat untrusted PDFs with the same caution you would give any parser input.
5. URL ingestion performs an outbound request to whatever address you pass. Do not accept URLs from untrusted users on a host with internal network access (SSRF risk).
6. Model output is untrusted input. Results are parsed into Pydantic models and rendered as text in the UI; never eval a result file or feed it into a shell command.

• The model producing a wrong or hallucinated finding. That is an accuracy problem — measure it with archagent eval and open a normal issue.
• Missing authentication on a locally-bound dev server (see item 3).