Security Policy
Supported versions
| Version | Supported |
|---|---|
| 1.0.0-rc.1 (prerelease) | Bounded CLI scope |
| 0.x and historical pre-reset commands | No |
The published version is v1.0.0-rc.1,
a prerelease, not stable and not Latest. Source version 1.0.0 is not a stable-release claim.
Design boundary
Bounded v1 protects against stale state and ordinary operator mistakes on a trusted local host. It validates physical repository binding, UUID, branch, declared lane and model label, action metadata, prompt digest, expected prior digest, runtime pin, and selected Git or Muse revision freshness. It confines managed reads/writes, refuses symlinks and hardlinks, and replaces NEXT atomically.
It is not a sandbox or a security boundary against the operating-system
administrator, root, or another malicious process running as the same user. It does
not verify the actual AI model, judge prompt quality, execute prompts, update itself,
merge, release, or deploy. Local handoff commands stay offline. Explicitly invoked
mirror deliver contacts MuseHub/GitHub, pushes the verified mirror commit and
creates or verifies its pull request; it never merges that request.
Reporting a vulnerability
Open a private GitHub security advisory at https://github.com/aaronrene/overseer-kit/security/advisories/new. Do not open a public issue for an undisclosed vulnerability.
Include the affected command/file, supported version, reproduction steps using a disposable Git repository when possible, impact, and whether local repository or same-user access is required. Never include real tokens, private keys, or consumer data in a report or fixture.
Historical modules outside the bounded-v1 entrypoint and third-party tools are not supported surfaces. A vulnerability that makes a supported v1 command escape its repository boundary, print a foreign/refused prompt, accept stale context, or expose data should be reported.