We release patches for security vulnerabilities in the following versions:

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them using one of the following methods:

Report a vulnerability privately using GitHub's built-in security advisory feature:

• Go to https://github.com/Parslee-ai/neo/security/advisories/new
• Fill in the details
• We will respond within 48 hours

Email security concerns to: hello@parslee.ai

Please include:

• Type of vulnerability
• Full paths of affected source files
• Location of the affected code (tag/branch/commit)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the vulnerability

• Initial Response: Within 48 hours
• Status Update: Within 5 business days with confirmation or questions
• Fix Timeline: Depends on severity
  • Critical: 1-7 days
  • High: 7-30 days
  • Medium: 30-90 days
  • Low: 90+ days

We follow coordinated disclosure:

1. Security report received and acknowledged
2. Issue confirmed and assessed for severity
3. Fix developed and tested
4. Security advisory published on GitHub
5. New version released with fix
6. Public disclosure after users have time to update

When using Neo:

• API Keys: Never commit API keys to Git. Use environment variables.
• Updates: Keep Neo updated to the latest version for security patches.
• Dependencies: Enable Dependabot alerts if forking this repository.
• Trusted Publishing: When publishing to PyPI, use GitHub Actions with Trusted Publishing instead of long-lived API tokens.

Neo stores facts locally in ~/.neo/facts/:

• Privacy: Fact files may contain code snippets and patterns from your projects
• Recommendation: Review fact files before sharing your system
• Location: ~/.neo/facts/facts_global.json, ~/.neo/facts/facts_org_{id}.json, ~/.neo/facts/facts_project_{id}.json

Neo requires API keys for language model providers:

• Storage: Keys stored in environment variables or ~/.neo/config.json
• Protection: Config file has restricted permissions (600)
• Recommendation: Use short-lived or scoped API keys when possible

We currently do not have a formal bug bounty program. However, we deeply appreciate security researchers who report vulnerabilities responsibly and will acknowledge your contribution in our release notes (if desired).

For general security questions: hello@parslee.ai

Thank you for helping keep Neo and our users safe!