Skip to content

SECURITY.md

Latest commit

 

History

History
23 lines (17 loc) · 994 Bytes

SECURITY.md

File metadata and controls

23 lines (17 loc) · 994 Bytes
Raw

Security policy

Supported versions

Only the latest release is supported.

Reporting a vulnerability

Please use GitHub's private vulnerability reporting — do not open a public issue for security problems. Reports are appreciated even when you are unsure whether something counts as a vulnerability.

Scope

  • This repository — the VS Code extension: webview UI, engine process management, local IPC. The extension talks to the engine on 127.0.0.1 only, generates a per-process Runtime token that stays out of command arguments, settings and logs, and collects nothing itself. Usage counting happens in the engine it starts; brotherwhale.telemetry turns that off.
  • The agent engine (codewhale CLI — model traffic, tools, sandboxing, prompts) is a separate project. Report engine vulnerabilities to Hmbown/CodeWhale, not here.