Skip to content

Security: timesbye/OPEN-AVATAR

Security

SECURITY.md

Security Policy

Supported Versions

The main branch receives security fixes.

Reporting a Vulnerability

Do not open a public issue for secrets, credential leaks, or exploitable security issues. Contact the maintainer privately using the GitHub account listed on the repository, or use GitHub private vulnerability reporting if it is enabled for the repository.

Please include:

  • A concise description of the vulnerability.
  • Affected files, versions, or Unity scenes.
  • Reproduction steps or proof of concept, if safe to share.
  • Suggested remediation, if known.

Secrets Handling

OpenAvatar supports external LLM providers. Never commit API keys, bearer tokens, GitHub credentials, Ollama service credentials, or private endpoint secrets. Use local environment variables, Unity user settings, or secure runtime configuration outside the repository.

There aren't any published security advisories