ragcite is pre-1.0. Only the latest released version on the default branch receives fixes.

Please do not open a public issue for security problems. Instead use GitHub's private vulnerability reporting for this repository.

Include a description, reproduction steps, and the affected version. I aim to acknowledge reports within a few days.

ragcite has no runtime dependencies and performs no network I/O of its own. The most likely concern is untrusted input: corpus and dataset files are parsed as JSON Lines, so treat their source accordingly.