refrag

The core implementation (embedder, compressor) does not use LLMs, which reduces immediate security risks associated with prompt injection or external API calls for core processing. The `REFRAGReranker` component, however, makes external API calls to OpenAI or Anthropic, which introduces standard risks of data privacy, reliance on external services, and potential cost accumulation. API keys are appropriately sourced from environment variables. The use of regex in `ChunkCompressor` for keyword extraction could, in theory, be susceptible to ReDoS attacks with crafted inputs, though the patterns used are relatively simple. An example in the documentation shows `pickle` usage for index saving/loading; loading pickled data from untrusted sources is a deserialization vulnerability, but this is an example for user implementation rather than a core library function.