rag-guard is actively maintained. Security fixes target the latest released version on the main branch.

Please do not open a public issue for security vulnerabilities.

Report privately through GitHub's Report a vulnerability flow (the repository's Security → Advisories tab). I aim to acknowledge reports within 72 hours and to ship a fix or mitigation for confirmed issues as quickly as is practical.

When reporting, please include:

• a description of the issue and its impact,
• steps to reproduce (a minimal proof-of-concept if possible), and
• any suggested remediation.

rag-guard is a dependency-light retrieval guardrail library. Findings of particular interest: prompt-injection or grounding bypass that defeats the refusal logic, PII leakage past the redaction layer, unsafe deserialization, and supply-chain risks in CI (this repository pins its GitHub Actions to commit SHAs and runs CodeQL + Dependabot to reduce that surface).

Thanks for helping keep it solid.