Only the latest stable release of Prompt Studio is supported with security patches.

Do not open a public issue for security bugs.

Report privately via GitHub Security Advisories or email the maintainer at btoshine774@gmail.com.

Expect an acknowledgement within 72 hours.

In scope:

• FastAPI backend (app/)
• Next.js frontend (frontend/)
• Alembic migrations (alembic/)
• lean-mcp/ middleware
• Skills, hooks, commands (skills/, hooks/, commands/)

Out of scope:

• Upstream LLM provider vulnerabilities (report to the provider)
• Issues requiring a pre-compromised host

API keys are read from environment variables. Never commit .env files.