If you discover a security vulnerability in flow2code, please do not report it in a public Issue.

1. GitHub Security Advisories (Recommended)
   Go to Security Advisories to create a private security report.

2. Email
   If the advisory option is unavailable, contact the maintainer directly via GitHub profile.

• Description of the vulnerability and its impact
• Steps to reproduce (the more detailed, the better)
• Affected versions
• Possible fixes (if any)

• Acknowledgment: Within 48 hours
• Initial assessment: Within 7 days
• Fix release: Depending on severity — critical vulnerabilities will be patched within 14 days

flow2code includes the following built-in security mechanisms:

• IR Security Validator (validateIRSecurity()) — Scans AI-generated IR for malicious code patterns
• Dangerous API Detection in Custom Code — Compile-time warnings for eval(), child_process, fs, and other dangerous calls
• Content-Security-Policy — Standalone dev server sets CSP headers
• Body Size Limit — API endpoints limit request body to 2MB
• Input Validation — IR validator checks structural correctness (version, nodes, edges, cycle detection)

Thank you for helping keep flow2code secure!