Security

SECURITY.md

Security Policy

Reporting Vulnerabilities

If you discover a security vulnerability in ContribPreflight, please report it responsibly.

Do not open public GitHub issues for security vulnerabilities.

Security Model

ContribPreflight is designed with the following security principles:

Target Repository Isolation

Target repositories are treated as untrusted input
ContribPreflight reads text files from target repositories only
No code execution from target repositories
No child_process, eval, dynamic import(), or require() of target content
No execution of discovered commands, scripts, or hooks
No loading of executable configuration from target repositories

Symlink Safety

Symlinked policy files are skipped entirely
Directory symlinks are not recursively followed
Path traversal outside the target root is prevented

No Remote Dependencies at Runtime

ContribPreflight operates entirely locally
No network requests during scanning
No LLM or API calls
No telemetry

Output Safety

JSON output is a single valid JSON document
No ANSI escape sequences in JSON or agent output
No shell injection vectors in output formatting

Scope

This security policy applies to ContribPreflight v0.1.0.

Limitations

ContribPreflight reads only a bounded set of file patterns
It does not guarantee complete coverage of all policy surfaces
It does not enforce or execute any discovered requirements

There aren't any published security advisories