Security

SECURITY.md

Security

Reporting Vulnerabilities

Do not open public issues for security vulnerabilities. Email: security@agentforge.dev

API Keys

API keys are stored in .env on the server
Never sent to the browser
Backend proxies all LLM requests

Best Practices

Use strong API keys
Rotate keys regularly
Run behind a reverse proxy in production
Set CORS_ORIGINS to your domain only

There aren’t any published security advisories