We release security updates for the latest version on the main branch.

If you discover a security issue in DataPilot, please report it privately.

Do not open a public issue. Instead, email the maintainers directly or use GitHub Security Advisories if available.

We will respond as quickly as possible and work with you to validate and fix the issue before any public disclosure.

• Never commit API keys, passwords, or tokens to the repository. Use .env and keep it out of version control.
• Rotate any API key that may have been exposed.
• Run DataPilot behind a reverse proxy with HTTPS in production.
• Keep Python dependencies up to date: pip install -r requirements.txt --upgrade.
• Review generated Pandas code and SQL queries before using them with sensitive data.

• Generated Python code runs inside a RestrictedPython sandbox.
• Generated SQL is scanned to block write operations and schema mutations.
• Uploaded files are stored in memory only and expire after a timeout.