The security of developers, their machines, and the repositories they inspect is fundamental to the design of FirstRun.

1. Zero Host Execution in Static Mode: FirstRun never executes code, scripts (postinstall, setup scripts, Makefiles, pip install hooks), or tests from the target repository during static checks. All inspection is strictly read-only static analysis.

2. No Secret Exposure: FirstRun actively avoids logging or outputting values found in .env files or secret configurations. When referencing keys, names, or configuration structures, sensitive values are redacted.

3. Safe Path Resolution & Symlink Containment: FirstRun resolves all paths relative to the canonical root of the target repository. Path traversals (e.g. ../../etc/passwd or malicious symlinks pointing outside the repository workspace) are strictly rejected to prevent unauthorized filesystem inspection.

4. Zero Remote Data Exfiltration: FirstRun runs 100% offline and locally. Inspected code, file paths, and report data are never sent to external servers or telemetry endpoints.

5. Realistic Sandboxing Guidance: When future execution verification modes are introduced (e.g., containerized execution), FirstRun will require explicit --allow-exec opt-in and will clearly state that containers (such as Docker) provide practical process isolation, not an impenetrable hardware security boundary.

If you discover a security vulnerability within FirstRun, please do not open a public GitHub issue.

Instead, please send a private report to:

• Email: security@firstrun.dev (or via GitHub Security Advisories)

Please include:

• A description of the vulnerability
• Steps to reproduce or a minimal proof of concept
• Potential impact and affected versions

We commit to acknowledging your report within 48 hours and providing a remediation plan and credit once resolved.