IntelliStream Chat is self-hosted chat that handles private messages, credentials, and file uploads, so we take security reports seriously. Thank you for helping keep it safe.

Please do not open a public GitHub issue for security vulnerabilities.

Report privately through one of:

• GitHub Security Advisories — the preferred channel: open a draft advisory under the repository's Security → Advisories → Report a vulnerability tab. This keeps the report private until a fix ships.
• Email — security@intellistream.ai with a subject starting [IntelliStream Chat security].

Please include:

• the affected version / commit,
• a description of the issue and its impact,
• reproduction steps or a proof-of-concept,
• any suggested remediation.

We aim to acknowledge a report within 72 hours and to agree on a disclosure timeline with you. We'll credit reporters in the release notes unless you prefer to remain anonymous.

Security fixes land on main and go out in the next 1.0.x patch release. There is no long-term support branch for older minors yet; when 1.1 ships, this table will say how long 1.0.x keeps getting fixes. Run a current 1.0.x build.

Several controls are the deploying operator's responsibility — the defaults are safe for local development but must be changed before exposing an instance:

• Rotate the bundled Keycloak client secret. keycloak/realm.json ships a well-known dev secret. Regenerate it in Keycloak and supply the new value via KEYCLOAK_CLIENT_SECRET (the app fails fast if it's unset in the prod profile).
• Remove the demo users (alice, bob) and the admin/admin Keycloak bootstrap account.
• Terminate TLS in front of the app and keep it bound to loopback (SERVER_ADDRESS=127.0.0.1) behind the proxy — see frontend.md. The app trusts X-Forwarded-* from its upstream.
• Set a concrete upload body cap at the edge (client_max_body_size) — workspace admins have no application-side upload ceiling.
• Back up the database and the data/ directory (attachments, avatars, Lucene index).

See README.md and QUICKSTART-MANUAL.md for the full production checklist.