If you find a security problem in OneSearch, please don't open a public issue. Report it privately through GitHub instead:

https://github.com/demigodmode/OneSearch/security/advisories/new

It helps to include the OneSearch version, how you're running it (Docker, Podman, external Meilisearch, remote agents) and steps to reproduce. This is a one-person project, so a reply can take a few days.

Fixes land in the latest release. Older versions don't get backports.

For how OneSearch handles authentication, network exposure and stored data, see the privacy and security docs.