Published releases are never modified; a fix always arrives as a new version, and affected releases get a notice in their release notes (see docs/RELEASING.md § Maintaining published releases).

Please do NOT open a public GitHub issue for security vulnerabilities.

To report a security vulnerability, please open a GitHub Security Advisory (private disclosure).

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if any)

We will acknowledge your report within 72 hours and aim to release a fix within 14 days for critical issues.

Security issues relevant to this project include:

• Command injection via the agentic <exec> tool interceptor (allow-list bypass)
• Path traversal in model file loading or mmap paths
• Buffer overflows in tokenizer, weight loading, or GGUF parsing
• Memory safety issues (use-after-free, out-of-bounds reads/writes)
• Integer overflows in size calculations or offset arithmetic

• The <exec> agentic tool is allow-listed to: echo, ls, cat, pwd, uname, date, id. All other commands are refused. See WALKTHROUGH_PHASE14.md for design rationale.
• Model files are loaded via mmap with PROT_READ — weights are never written to.
• The engine does not make network requests at runtime.

A prior independent security audit is documented in SECURITY_FINDINGS.md and INDEPENDENT_CODE_AUDIT_REPORT.md.