Reporting Security Issues#

We take security bugs in assistant-ui seriously. We appreciate your efforts to responsibly disclose your findings, and will make every effort to acknowledge your contributions.

To report a security issue, please use the GitHub Security Advisory "Report a Vulnerability" tab. Do not open a public issue or pull request for a vulnerability, and that includes findings from maintainers, audits, and coding agents.

If you cannot use GitHub, email security@assistant-ui.com. To encrypt your report, use our PGP key (fingerprint B86D FB72 8A96 0262 ACE0 26BD 6DB8 1BBC 50A3 337E).

Scope#

In scope: the packages published from this repository, the shadcn registry components, and the hosted services on assistant-ui.com.

A vulnerability is a way for untrusted input (model output, tool results, MCP servers, remote agents, or another user) to run code, bypass authorization, read or change another user's data, gain privileges it should not have, read or send credentials, cross an origin or sandbox boundary, or exhaust a hosted service. These are examples, not a complete list. Hardening with no exploit path can be a public issue.

What to include#

The affected package, component or service, its version or deployment if you know it, a minimal reproduction or proof of concept, and the impact you expect.

What happens next#

Our team will send a response indicating the next steps in handling your report. After the initial reply to your report, the security team will keep you informed of the progress towards a fix and full announcement, and may ask for additional information or guidance.

Supported Versions#