semqa is pre-1.0. Security fixes are applied to the latest 0.x release only.

Please do not open a public issue for security problems. Instead, use GitHub's private vulnerability reporting on this repository.

We'll acknowledge within a few business days and keep you updated on the fix.

semqa is a governance layer; a few security properties are intentional and worth understanding when assessing it:

• Identity comes from a verified, signed token — never from the prompt. Treat a forged or stolen token as a real risk: token verification is necessary but not sufficient. Use least-privilege, short-lived, audience-bound tokens, and propagate identity to native row-level security at the source.
• The answer path is read-only by construction (Rule-of-Two). This bounds the blast radius of prompt injection — it does not prevent injection. If you add a tool, keep read tools free of outbound side effects, or you reintroduce an exfiltration channel.
• semqa does not eliminate hallucination or guarantee accuracy. It converts insufficient/ungoverned cases into abstentions. Don't rely on it as a correctness guarantee for downstream automation.