Security fixes are applied to the latest release on the main branch.

Please do not open public GitHub issues for security vulnerabilities.

Email maintainers privately with:

• A description of the issue and potential impact
• Steps to reproduce
• Affected components (backend, frontend, SDK)
• Suggested fix, if available

We aim to acknowledge reports within 72 hours.

• Set PROMPTLENS_API_KEY in production. The API rejects unauthenticated requests when this is configured.
• Use the root docker-compose.prod.yml stack: PostgreSQL, API, frontend, and Caddy with optional automatic HTTPS.
• Copy .env.prod.example to .env.prod and run ./scripts/prod-up.sh from the repository root.
• Restrict PROMPTLENS_CORS_ORIGINS to trusted dashboard and SDK client origins.
• Prefer same-origin deployment (VITE_PROMPTLENS_API_URL=/api/v1 behind Caddy) so the dashboard does not require cross-origin access.
• Do not expose /docs in production (disabled automatically when PROMPTLENS_ENVIRONMENT=production).
• Treat event metadata as sensitive — it may contain prompts, tool outputs, and RAG context.