Auto_BI is pre-1.0 (a single evolving main branch, no maintained release branches yet). Security fixes land on main; there is no LTS or backport policy at this stage.

Please do not open a public GitHub issue for security vulnerabilities. Instead, use GitHub Security Advisories ("Report a vulnerability" on the repo's Security tab) so the report stays private until a fix is available.

Include, where relevant: the affected component (agent core / adapters / API / web UI), the DWH engine and BI target involved, and a minimal reproduction (the spec or query that triggers the issue). This is a solo-maintained project — no response-time SLA is guaranteed, but reports will be acknowledged and triaged.

Auto_BI sits between an LLM, a read-only DWH connection, and a BI platform's admin-level API. The design constraints that bound its attack surface (see ARCHITECTURE.md §4 for the source of truth):

• DWH access is read-only and schema-scoped. The configured DWH role should see only the data-mart schemas Auto_BI is meant to serve — never production OLTP or unrelated schemas.
• Generated SQL is guarded before execution. Every query is parsed with sqlglot; only SELECT is allowed (no DDL/DML, no multi-statement), and validation runs go through EXPLAIN plus a forced LIMIT before anything is built.
• The LLM never emits native BI payloads. It only produces a validated DashboardSpec (IR); all Superset/DataLens API calls are generated by deterministic adapter code, not by model output.
• What reaches the LLM is controlled. Schema and structural metadata are always sent for grounding; actual data values (top-N distinct values of low-cardinality columns) are off by default (AUTO_BI_SEND_SAMPLES=false). Enabling samples is an explicit opt-in and still respects per-table/column classification (public / internal may send; confidential / restricted never do). Free-text fields are sanitized and wrapped as untrusted data in the prompt. See .env.example, USER_GUIDE §6, and MIGRATION_SEND_SAMPLES.md.
• Secrets live only in .env (git-ignored), never in code, logs, or committed docs.
• The BI service account should be scoped to a dedicated workspace/folder (e.g. the "Auto_BI" workbook in DataLens), not a shared or production one.
• Auth is opt-in (AUTO_BI_AUTH_ENABLED); when enabled, sessions are schema-scoped by RBAC (see USER_GUIDE §7) and tokens are stored server-side.

• Auth tokens are stored as sha256(token) in the local SQLite store, not plaintext — a stolen store file does not yield a live bearer token directly.
• The login endpoint (/api/v1/auth/login) is rate-limited in-process: 5 attempts/minute per client IP, with a lockout that grows exponentially on repeated violations (capped at 15 minutes).
• The session cookie's Secure flag is forced on by default for any non-loopback bind host (AUTO_BI_AUTH_COOKIE_SECURE overrides either way — see docs/USER_GUIDE.md §6/§7).

Still recommended: run auto_bi serve behind a reverse proxy that terminates TLS — the app itself does not speak HTTPS (see docs/DEPLOYMENT.md, planned).

Dependency updates, including security patches, are tracked via Dependabot (.github/dependabot.yml) and go through the same CI gate as any other change. Version bumps are grouped (minor/patch) to keep review load small; major bumps stay as separate PRs.

Dependabot security updates (auto-PRs for known advisories) are a repository security setting separate from dependabot.yml. Enable with the operator script in DEPLOYMENT.md §11 after an explicit admin gate — do not assume the UI toggle is on.

main and v* tags are meant to be enforced by GitHub repository rulesets (required CI/CodeQL/gitleaks checks, PR-only main, no force-push/delete, immutable release tags). Local scaffolding:

• .github/CODEOWNERS
• .github/pull_request_template.md (security / data / docs / release checklists)
• scripts/apply_github_protection.py (dry-run by default)

Applying rulesets or flipping security-updates is an admin external operation — see DEPLOYMENT §11. Solo-maintainer residual: code-owner required review and environment pypi prevent_self_review stay off until a second human reviewer exists (otherwise merges and releases deadlock).