AI Knowledge Fleet is a static, client-side-only site (index.html + JSON/Markdown/HTML content files). It has:

• No backend, no server-side code, no database.
• No authentication, no user accounts, no cookies or reader tracking.
• No collection of reader data.

Given this scope, most traditional web vulnerability classes (SQLi, auth bypass, server RCE) don't apply. Realistic concerns are limited to things like:

• Client-side XSS (e.g. via unsanitized Markdown/HTML rendering, [[wikilink]] resolution, or mermaid.js diagram rendering).
• Malicious or unsafe content injected through a contributed manifest/content file.
• Supply-chain issues in CDN-loaded dependencies (Tailwind, markdown-it, mermaid.js).

Please do not open a public GitHub issue for security concerns.

Instead, report privately via email: trangdangkhai@gmail.com

Include:

• A description of the issue and its potential impact.
• Steps to reproduce (e.g. specific URL/hash route, content file, or input).
• Your suggested fix, if you have one.

You should expect an initial response within a few days. Since this is a small, static-content project maintained outside of full-time work, timelines for a fix will depend on severity, but confirmed reports will be acknowledged and credited (unless you prefer otherwise) once resolved.

This repo does not maintain release branches; only the latest main (as deployed to GitHub Pages) is supported.