Do not open a public issue. Email security disclosures to:

perseus@perseus.observer

You will receive a response within 48 hours. Perseus Computing LLC is a US-owned small business and treats security reports as confidential until a fix is published.

• Affected version(s)
• Steps to reproduce
• Impact assessment (what an attacker could do)
• Any suggested mitigations

1. Acknowledgment — within 48 hours
2. Triage — severity assessment within 5 business days
3. Fix development — timeline depends on severity
4. Coordinated disclosure — CVE assigned, fix released, advisory published

We support responsible disclosure and will credit reporters who follow this policy.

Keep vulnerability reports private. The public security model and reporting policy are maintained in this document; internal response records and access details are not part of the public repository.

Perseus Context Engine is primarily a context renderer. It can write an explicitly selected output file and can also expose optional commands, services, hooks, and persistent state when the operator enables them. Those optional paths are part of the security boundary, not a sandbox.

Default posture:

• Local workspace sources are resolved without a Perseus-hosted service.
• Shell, local-agent, service-command, and remote-health operations are disabled unless explicitly enabled.
• Enabled commands run with the current user's permissions and are not sandboxed.
• Authored HTTP directives, network transports, connectors, model providers, and external integrations can send operator-selected data to configured destinations.
• Output, checkpoint, cache, and memory features write to paths selected by the operator or configuration.

Perseus does not require a Perseus-hosted API key for its default local render path. It can read environment variables, local files, or provider credentials that the operator exposes to an enabled directive or integration, so secrets must remain outside committed context sources and rendered artifacts.

• You author the directives. Perseus resolves the operations that policy allows. The assistant reads the resulting artifact.
• Conversation data is not an implicit input. A host or integration can still pass conversation-derived data if the operator configures that path.
• Credentials are operator-scoped inputs. The default renderer does not require a Perseus-hosted credential, but enabled environment, file, HTTP, model-provider, and integration paths can access credentials exposed to the process.

• Runtime dependencies: PyYAML (unconditional) and tomli (Python <3.11 fallback), both MIT-licensed
• Perseus source has no native extensions; PyYAML may install a platform-specific compiled extension wheel
• SBOM published at docs/SBOM.md
• We monitor GitHub Advisory Database for PyYAML and tomli CVEs
• Dependencies pinned with hash checking in progress

The published package currently uses PyPI trusted publishing, but this repository does not claim a SLSA provenance attestation or separate code-signing artifact for Perseus Context Engine 1.0.26. Trusted publishing authenticates the upload workflow; it is not the same as a downloadable SLSA or Sigstore attestation.

Verify the selected package version and archive digest against PyPI before installation. For example:

python - <<'PY'
import hashlib, json, urllib.request
version = "1.0.26"
metadata = json.load(urllib.request.urlopen(f"https://pypi.org/pypi/perseus-ctx/{version}/json"))
for item in metadata["urls"]:
    print(item["filename"], item["digests"]["sha256"])
PY

A digest comparison verifies downloaded bytes against the package registry record. It does not certify runtime behavior or confer deployment authorization.

Security: perseus@perseus.observer

PGP — encrypt sensitive reports to our security key:

Fingerprint: 92C8 E815 1A60 DB38 46DB  420B 029A 35A6 A22B 287E

Fetch it from keys.openpgp.org (gpg --keyserver hkps://keys.openpgp.org --recv-keys 92C8E8151A60DB3846DB420B029A35A6A22B287E) and verify the fingerprint above before use.