The current development target is v0.1.0 Alpha/MVP. Security fixes are evaluated against the latest code on the default branch. Because this is an early release, support and response times are best effort.

Please report suspected vulnerabilities privately through the private security or maintainer contact channel provided by the repository host. If the host does not expose one, ask a maintainer for a private channel without posting the vulnerability details publicly.

Include only the information needed to reproduce and assess the issue:

• affected version or commit;
• affected route, component, or configuration;
• a minimal reproduction or proof of concept that is safe to share privately;
• impact and any relevant assumptions.

Please allow maintainers reasonable time to investigate and coordinate a fix before public disclosure. Do not open a public issue, pull request, or chat message containing exploit instructions, private user content, credentials, or API keys.

• Never commit WENSI_API_KEY, provider tokens, passwords, or real .env files.
• Keep model credentials in server-side environment configuration. They must not be sent to browser bundles or exposed through NEXT_PUBLIC_ variables.
• The checked-in .env.example contains placeholders only; replace them locally and keep the real file untracked.
• If a secret is accidentally exposed, revoke or rotate it immediately, then notify maintainers privately.

The default demo mode generates in the browser and stores recent history only in the browser's localStorage; Wensi does not collect writing content by default. Online mode sends the topic, keywords, writing options, and any real experiences entered by the user to the configured model service through the server-side /api/generate route. Review that provider's privacy, logging, and retention practices before enabling it, and avoid entering sensitive information unless you understand the consequences.