Security Policy

Supported Versions

PaperSeek is currently in alpha. Security fixes target the latest main branch and the latest published package version, if any.

Please report security issues privately to:

hongmingfeng24@mails.ucas.ac.cn

Do not open a public issue for leaked credentials, account access problems, or vulnerabilities involving API keys.

Web UI session values are temporary and are not written to disk by PaperSeek.
CLI user configuration is stored locally and masks secrets when listed.
.env, .env.*, user config files, build output, and caches should not be committed.
Agent Skill files must not contain real API keys.

PaperSeek does not bypass paywalls, download protected PDFs, or manage publisher/database login sessions.