Security & compliance

Honesty rule: ContextForge produces a draft context pack from what you paste. It is not a security certification, penetration test, or legal advice. We do not claim “never miss” or “100% accurate conventions.”

Fail-closed AI (P0)

Missing key → 503; upstream failure → 502; quota → 429 before the model call; demo mode is labelled; live success carries source: Model-assisted. Rule-based drafts are labelled Rule-based.

Data minimization

No repository connector and no durable product database for pasted trees. Prefer trees and a few key files; do not paste secrets. See privacy.html.

OWASP LLM01 — prompt injection

Pasted content is untrusted. Extraction and support chat treat embedded “ignore previous instructions” text as data, not commands. Ref: OWASP Top 10 for LLM Applications (LLM01).

Contact

Security questionnaires: lixingliangsy@163.com.