Hermes Visual Workspace is currently alpha software. Security fixes are applied to the latest commit on main; older commits and private forks are not maintained as supported release lines.

Use GitHub's private vulnerability reporting flow:

1. Open this repository's Security tab.
2. Select Report a vulnerability.
3. Include affected versions, reproduction steps, impact and any suggested mitigation.

Do not open a public issue, discussion or pull request for a suspected vulnerability. Please avoid including real API keys, provider tokens, conversation data or private Hermes state in a report.

The intended deployment is local or on a trusted private network:

• The browser talks only to same-origin application endpoints.
• Hermes API and provider credentials remain server-side.
• The upstream Hermes API must remain bound to loopback.
• Application ownership is enforced with rh_... session IDs and rw_... workspace IDs.
• The application does not provide public-network authentication or multi-tenant authorization.

Exposing the server directly to the public Internet is unsupported and unsafe.