If you discover a security vulnerability in oddeNova, please report it by opening a GitHub Issue with the label security. For sensitive disclosures, contact the maintainer directly via GitHub.
Please include:
- A description of the vulnerability
- Steps to reproduce
- Potential impact
We aim to acknowledge reports within 48 hours and provide a fix timeline within 7 days for critical issues.
- Never commit API keys to the repository. All API keys are entered through the in-app UI and stored in
localStorage— they are never sent to our servers. - The
.gitignoreexcludes.envand.env.localfiles. - ESLint rules prevent importing from internal
superdough/*subpaths that could inadvertently expose audio context state.
| Version | Supported |
|---|---|
| latest (main branch) | ✅ |
| older commits | ❌ |