pgokf is pre-1.0. Security fixes are made against the latest release; older tags do not receive backports. Upgrade to the newest release to receive fixes.

Please do not open a public GitHub issue for a security vulnerability.

Report it privately through GitHub's Private vulnerability reporting: the Security → Report a vulnerability button on this repository. If that button is unavailable to you, open a public issue that says only "security report, please reach out" with a way to contact you - do not include any vulnerability details in the issue - and we will move to a private channel.

Please include: the affected version/commit, a description of the issue, and a minimal reproduction if you have one. We aim to acknowledge a report within a few business days and to coordinate a fix and disclosure timeline with you.

pgokf runs inside PostgreSQL and treats a filesystem path and bundle content as privileged, untrusted input. The security model - role tiers, SECURITY DEFINER hardening, path-traversal/symlink defenses, resource ceilings, and the multi-tenancy trust model (including the important caveat that the pgokf.tenant GUC is a scoping selector, not a hard boundary against a tenant who can run arbitrary SQL) - is documented in docs/security.md and docs/multi-tenancy.md. Read those before deploying in a multi-tenant or untrusted-input setting.

The companion tools (pgokf-ingest, pgokf-embed, pgokf-mcp) hold object-store / embedding-endpoint credentials in their own environment and never send them to PostgreSQL; they support TLS to PostgreSQL via --tls / sslmode=require.

A companion that listens on a socket authenticates every request: pgokf-web signs people in (OpenID Connect, a trusted proxy's headers, or a local users file) and pgokf-mcp --http requires a bearer token whose role decides which tools it may call. Neither terminates TLS; both are meant to sit behind a TLS-terminating reverse proxy on a loopback or private interface.