openConcierge is self-hosted software that handles customer conversations and personal data. We take security seriously and appreciate responsible disclosure.

openConcierge is pre-1.0 and moves quickly. Security fixes land on main — please run a recent commit. There are no long-term-support branches yet.

Please do not open a public issue for security problems.

Report privately through GitHub Security Advisories:

👉 https://github.com/nullarch/openconcierge/security/advisories/new

Please include a description, reproduction steps, the affected version/commit, and the impact. We aim to acknowledge within 72 hours and to ship a fix or mitigation as quickly as the severity warrants. We're happy to credit you unless you'd prefer to stay anonymous.

Because you self-host, your deployment's security is ultimately yours. The highest-value reports concern the code itself:

• authentication / session handling (src/lib/auth.ts, src/lib/password.ts)
• the widget ↔ desk trust boundary and anonymous-visitor identity
• SQL construction (src/lib/db.ts and callers)
• file-upload handling (src/lib/storage.ts, the upload routes)
• SSRF via URL ingestion in the knowledge base (src/lib/ai/)
• secret handling and accidental exposure

Misconfigured infrastructure (a publicly reachable DATABASE_URL, missing TLS, a committed .env) is out of scope, but the README's self-hosting section has hardening notes to help you avoid it.