Cepheid is in early development (pre-1.0). Security fixes target the latest main; there are no released versions to backport to yet.

Please report suspected vulnerabilities privately — do not open a public issue.

Use GitHub's private vulnerability reporting: on the repository, go to the Security tab → Report a vulnerability. This opens a private advisory channel with the maintainer.

Please include:

• a description of the issue and its impact,
• steps to reproduce or a proof of concept,
• the affected component and commit SHA, and
• any suggested remediation.

You can expect an initial acknowledgement within a few days. Once a fix is ready, we'll coordinate disclosure with you.

• The default Postgres/Neo4j credentials in docker-compose.yml and src/cepheid/config.py (cepheid_dev_password) are local-development defaults, not secrets. Override them via environment variables / .env in any non-local deployment.
• API keys belong in .env (gitignored), never in tracked files.