If you discover a security vulnerability in Subgeneratorr, please report it responsibly.

Email: Open a GitHub Security Advisory (preferred) or create a private issue.

Please do not open a public issue for security vulnerabilities.

• Authentication or authorization bypasses
• API key exposure or leakage
• Container escape or privilege escalation
• Dependency vulnerabilities with known exploits

Subgeneratorr handles several API keys (Deepgram, Anthropic, OpenAI, Gemini). These are:

• Stored only in the .env file (gitignored)
• Passed to containers via environment variables
• Never exposed to the browser or frontend JavaScript
• Never logged or written to output files

If you find a case where an API key is inadvertently exposed, please report it immediately.