ConvergioAI is in its early public release phase. Security updates will be applied to the latest version on the main branch.

We take security seriously at ConvergioAI. If you discover a security vulnerability, please report it responsibly.

Do not open a public GitHub issue for security vulnerabilities.

Instead, please report vulnerabilities through one of these channels:

1. GitHub Security Advisories (Preferred): Use GitHub's private vulnerability reporting to submit a confidential report directly through this repository.

2. Email: Send details to security@digitechnomads.com with the subject line [ConvergioAI Security].

• A clear description of the vulnerability
• Steps to reproduce the issue
• The potential impact or severity
• Any suggested fixes (optional but appreciated)

When self-hosting ConvergioAI, follow these guidelines:

• Never commit .env files or expose secrets in source control
• Use strong, unique values for BETTER_AUTH_SECRET
• Keep dependencies updated — run npm audit regularly
• Use HTTPS in production for all API and frontend traffic
• Restrict database access — do not expose PostgreSQL to the public internet
• Review API keys — rotate Anthropic API keys periodically

The following are in scope for security reports:

• Authentication and session management vulnerabilities
• API endpoint authorization bypasses
• SQL injection, XSS, CSRF, and other OWASP Top 10 issues
• Sensitive data exposure in API responses
• Dependency vulnerabilities with a known exploit

The following are out of scope:

• Vulnerabilities in third-party services (Anthropic API, Cal.com, Hostinger)
• Social engineering attacks
• Denial of service (DoS) attacks
• Issues in environments running unsupported or modified versions

We appreciate security researchers who help keep ConvergioAI safe. With your permission, we will acknowledge your contribution in the release notes of the security patch.