Only the latest two minor versions receive security updates. We recommend always running the most recent release.

We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please email security concerns directly to:

hendrik.reh@blacksmith-consulting.ai

• Description of the vulnerability
• Steps to reproduce (if applicable)
• Affected components (e.g., rag-server, rag-core, agent-core)
• Potential impact assessment
• Any suggested fixes (optional)

1. Acknowledgment: We will confirm receipt of your report within 48 hours
2. Assessment: We will investigate and assess the severity
3. Communication: We will keep you informed of our progress
4. Credit: With your permission, we will credit you in the security advisory

Apex Accelerator is a document ingestion and retrieval system for RAG applications. The security model addresses:

• Multi-mode authentication: None, API Key, or OIDC (Keycloak)
• OIDC identity security: Issuer+Subject triplet for user uniqueness (v0.9.0)
• JWT validation: Algorithm allowlist (RS256, ES256), issuer URL normalization, typ header validation
• Concurrent login safety: Atomic upsert with ON CONFLICT DO UPDATE prevents race conditions
• Tenant isolation: All data-layer operations scoped by tenant ID with type-safe TenantId newtype (v0.10.0)
• Session tracking: 4-level ID hierarchy (request → run → conversation → session)
• Document identity: Formalized (tenant, id) semantics via ADR-002 (v0.11.0)

• Path allowlisting: Document ingestion restricted to INGEST_ROOT
• SQL safety layer: Query allowlisting, read-only validation, DoS protection, type confusion prevention (v0.9.0, v0.11.0)
• Input validation: Collection names, tenant IDs, and search queries are validated
• PII protection: Email address hashing for Prometheus labels (v0.12.0)
  • Content owner emails in refresh cadence system never exposed in metrics
  • SMTP credentials environment-only (REFRESH_SMTP_PASSWORD) - never in configuration files
• Database migrations: Versioned migrations with sqlx for schema safety (v0.11.0)

• Prompt injection detection: Configurable blocklist and pattern matching
• PII redaction: Optional redaction of emails, phone numbers, SSNs, credit cards
• Hallucination prevention: System prompts with critical constraints

When deploying Apex Accelerator:

1. Never expose without authentication in production (AUTH_MODE=api-key or AUTH_MODE=oidc)
2. Use secrets management for sensitive credentials:
   • OPENAI_API_KEY, DATABASE_URL, QDRANT_API_KEY
   • REFRESH_SMTP_PASSWORD (email notifications)
   • API keys (AUTH_API_KEYS)
   • OIDC client secrets (OIDC_CLIENT_SECRET)
3. Restrict INGEST_ROOT to the minimum necessary directory scope
4. Enable guardrails (GUARDRAIL_INJECTION_ENABLED=true)
5. Use HTTPS in production deployments
6. Rotate credentials periodically:
   • API keys when using AUTH_MODE=api-key
   • SMTP passwords annually (v0.12.0+)
   • Database connection strings if compromised
7. Enable refresh cadence security features (v0.12.0+):
   • Auto-deprecation safety (auto_deprecate_enabled=false initially)
   • Auto-hard-delete disabled (auto_hard_delete=false unless required)
   • Email notification validation before enabling
8. Multi-tenant isolation:
   • Validate tenant claims in JWT tokens
   • Use separate tenants for different security contexts
   • Monitor cross-tenant access attempts via metrics

We use cargo audit to scan Cargo.lock against the RustSec Advisory Database for known vulnerabilities, unmaintained crates, and unsoundness issues.

cargo audit

Policy:

• cargo audit is run before each release and as part of CI
• Vulnerabilities (error-level) in core crates (rag-core, rag-server, rag-cli, agent-core, rag-chunking) must be resolved before release
• Unmaintained/unsound warnings in transitive dependencies (e.g., Tauri GTK3 bindings) are tracked and reviewed periodically but do not block releases
• Dependency updates are tracked via Dependabot PRs and cargo update

Last audit (v0.20.0): 0 vulnerabilities, 22 warnings (all in Tauri desktop tool transitive dependencies).

The following are in scope for security reports:

• Authentication/authorization bypasses
• Tenant isolation violations
• SQL injection or command injection
• Path traversal vulnerabilities
• Prompt injection bypasses (guardrail evasion)
• Information disclosure across tenants
• Denial of service vulnerabilities
• OIDC/JWT validation bypasses
• Race conditions in concurrent operations
• PII leakage in logs, metrics, or error messages
• SMTP credential exposure
• Refresh cadence system security issues (auto-deprecation abuse, unauthorized document access)

The following are out of scope:

• Vulnerabilities in dependencies (report to upstream maintainers)
• Social engineering attacks
• Physical security
• Issues requiring already-compromised credentials

We appreciate the security research community's efforts in responsibly disclosing vulnerabilities. Contributors who report valid security issues will be acknowledged (with permission) in our release notes.

Version: 0.25.3 Last updated: 2026-03-09 Maintained By: hendrik.reh@blacksmith-consulting.ai