Please do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting feature on this repository instead.

Include the affected component, reproduction steps, impact, and any suggested mitigation. Please avoid testing against systems or repositories you do not own.

Orca is designed to run behind a private network boundary. Keep the controller, worker, Redis, Bifrost, Ollama, and n8n management interfaces private. Expose only the signed Slack webhook relay.

Use separate, least-privilege credentials for Slack, GitHub, the worker API, GitHub webhooks, and hosted model providers. Never commit a populated .env file or anything from .secrets/.

Before deploying, review the permissions described in the README and rotate any credential that may have appeared in logs, chat, screenshots, or Git history.