RepoPlanner is local-first and indexes source code. Treat indexed data as sensitive.

Until a dedicated security contact is published, please open a private security advisory on GitHub if available, or contact the maintainer directly.

• Do not send repository contents to third-party services by default.
• Do not require API keys for the MVP.
• Keep local indexes out of git.
• Avoid logging secrets or file contents unnecessarily.