Security Advisories
Report privately, get a human, and see it fixed in the open.
Reporting a vulnerability
Report privately to security@interlock.solutions. Encrypt if you prefer — ask in a first message and we will send a key.
Please do not open a public issue for a security report, and please do not send it to a sales address. The engine's source repositories are not currently public, so GitHub Security Advisories is not a route an external reporter can use; email is the channel.
What to include
The version or commit, the tier, and the smallest reproduction you can manage. A failing test is the ideal report — it makes the fix verifiable rather than argued.
If the issue involves credential handling, describe the path without pasting a live credential; a redacted sentinel is enough to demonstrate a leak.
What to expect
An acknowledgement from a person, an assessment of severity and affected tiers, and a fix developed in private until it is ready to land.
Once a fix is available we publish an advisory naming the affected versions, the affected tiers and the upgrade path, and notify reporters directly.
Scope
In scope: the COODDEE engine, its executors and adapters, the board UI, and the compliance scanners.
Out of scope: vulnerabilities in third-party model providers reached through an adapter, and findings that require an already-compromised operator account. A report that a superuser database role bypasses row-level security is expected behaviour of PostgreSQL — cooddee init already warns about it.