Authentication and rate limiting, untrusted-filename handling, opt-in integrations (SMTP, webhooks, OCR, models, Postgres, Redis, Docker) and the deliberately deferred boundary list are covered in docs/SECURITY.md, with the roadmap in ROADMAP.md.
Open a security advisory
or email fishraposo@gmail.com with the subject [groundtruth security]. Please do
not open a public issue for a security report.
Security fixes target the latest tagged release and main.