Please do not open a public issue. Report it privately through GitHub's vulnerability reporting: https://github.com/structured-world/coordinode-python/security/advisories/new

Include the affected package (coordinode, coordinode-embedded, langchain-coordinode or llama-index-graph-stores-coordinode), its version, the steps to reproduce, and what an attacker gains. You get a first answer within a few working days, and the fix is published together with an advisory that credits you unless you ask otherwise.

A vulnerability in the CoordiNode server itself belongs to the server repository: https://github.com/structured-world/coordinode/security.

Fixes land in the latest release of each package. Older releases are not patched; upgrade to the latest one.