Please report security problems privately through GitHub: open the repository's Security tab and choose Report a vulnerability. Do not open a public issue. The repository owner must enable private vulnerability reporting in the repository settings for this form to appear.

Include the Seyk version or commit, your platform, steps to reproduce, and the impact you expect.

Security fixes are made on the latest release and on main.

Problems that break Seyk's guarantees, for example:

• content, queries or vectors leaving the machine without an explicit command;
• the cache or logs exposing readable source text;
• reads outside the configured roots, or symlink and path confinement bypasses;
• extraction returning text that does not match the verified content hash;
• model or asset integrity checks that can be bypassed.

• Attacks that already require the same user account's access to the cache or model directories (see Where things are stored).
• PII detection or redaction, which Seyk does not provide.