Security Policy

Reporting a Vulnerability

If you discover a security vulnerability in AG-UI DevTools, please report it privately:

• Open a GitHub Security Advisory: Go to Security > Advisories and click "Report a new vulnerability."
• Do not open a public issue for security vulnerabilities.

We will respond within 48 hours and keep you updated on the fix progress.

Known Security Considerations

API Key in Frontend Bundle (VITE_API_KEY)

VITE_API_KEY is embedded in the JavaScript bundle at build time. Only use this in development. For production, use a reverse proxy with infrastructure-level authentication. See the Security Considerations section in the README.

SSE Query Parameter (api_key)

The EventSource API does not support custom headers, so the API key is sent as a URL query parameter for SSE streams. Use HTTPS in production and prefer x-api-key header for all non-SSE requests.

Supported Versions

Version	Supported
0.1.x	Yes

As the project is pre-1.0, only the latest release receives security fixes.