Please do NOT open a public GitHub issue for security vulnerabilities.

Report privately via GitHub: go to the Security tab and click "Report a vulnerability."

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

You will receive a response within 48 hours.

Every project generated by Genesis Architect includes:

• Secret scanning CI job: scans full Git history on every push
• SAST analysis CI job: static analysis for injection and path traversal
• Code quality gate: merge blocked on security regressions
• Path traversal guard: get_safe_path in all projects handling user-supplied file paths
• Non-root Dockerfile: USER 1001 in all generated containers
• Strict .gitignore: blocks .env, *.pem, *.key from commits
• Pre-commit hook: local secret scanning before files reach GitHub

This project uses automated dependency scanning on every push. Check the Security tab for current status.

Enable Dependabot by adding .github/dependabot.yml:

version: 2
updates:
  - package-ecosystem: "pip"
    directory: "/"
    schedule:
      interval: "weekly"