IntentLang is currently experimental (v0.7.x line). Security controls exist, but there are no guarantees of production readiness.

Supported branch/version for security fixes in this repo:

• v0.7.x (current)

Please do not disclose exploit details publicly first.

Because no private contact channel is published in this repository:

1. Prefer opening a GitHub Security Advisory draft for this repository (if enabled).
2. If Security Advisories are unavailable, open a minimal GitHub issue requesting a private contact channel.
   • Do not include exploit steps, payloads, secrets, tokens, credentials, or private data.
   • Include only high-level impact and affected area.

• Affected version/commit
• High-level impact
• Minimal reproduction outline without secrets
• Suggested remediation direction (optional)

• Never commit passwords, tokens, API keys, or secret-bearing test values.
• Tests should generate ephemeral auth inputs at runtime.
• Issues/PRs must not contain private user data or credential material.
• The INTENTLANG_AI_API_KEY environment variable is never logged, serialized, returned to the browser, or included in error messages.

AI assistance is optional and off by default. The following threat areas apply when AI is enabled:

User-supplied source content is delimited with <<CURRENT_SOURCE_START>> / <<CURRENT_SOURCE_END>> markers and the system prompt instructs the model to treat delimited content as data, not instructions. However, prompt injection is an inherent risk in all LLM systems. Mitigations:

• Proposals always go through deterministic compiler validation before any user action is possible.
• Invalid proposals are rejected with diagnostics and cannot be applied.
• AI output is untrusted text: it cannot write files, execute commands, access databases, read arbitrary files, or override compiler errors.

The provider endpoint is configured at server startup via CLI flags only — the browser cannot override it. Mitigations:

• Only loopback endpoints (127.0.0.1, localhost, ::1) are permitted by default.
• Remote endpoints require explicit --allow-remote-ai and must use HTTPS.
• Credentials in URLs are rejected at startup.
• redirect: 'error' is used on all provider fetch calls.
• The browser receives only the provider id, model name, and endpoint origin — never the API key.

The INTENTLANG_AI_API_KEY environment variable is the only way to supply an API key. Mitigations:

• For openai-compatible, key is attached via Authorization: Bearer header server-side only.
• For gemini, key is attached via x-goog-api-key header (not URL query parameter) server-side only.
• Key is never logged, written to disk, returned to the browser, or included in error messages.
• Provider error responses that might echo headers are not forwarded to the browser.

--ai-provider gemini connects directly to https://generativelanguage.googleapis.com/v1beta (or a custom endpoint). This is a remote provider: it always requires --allow-remote-ai and HTTPS. The same SSRF and API key mitigations listed above apply. Free-tier availability, quotas, billing, and terms are controlled by Google and can change.

AI-generated text is rendered via textContent only — no innerHTML on any AI output. The diff pane uses DOM element creation. No HTML is rendered from model responses.

• We will triage reports best-effort.
• Fix timelines are not guaranteed.
• Public disclosure should wait until maintainers acknowledge and coordinate.

This project is provided without security guarantees. Users must perform independent review and risk assessment before real-world use.