mirror of
https://github.com/storytold/craft-anything.git
synced 2026-11-05 20:47:45 +01:00
Brandon Thomas
f64ae3bf3c
A native, pure-Rust app that shows anyone how a piece of software works, with evidence-backed answers, then helps them rebuild it. It ships a desktop app, a CLI and an MCP server, all driven by one engine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
980 B
980 B
Security
Craft Anything reads hostile files and runs other programs, so we take reports seriously.
Reporting a vulnerability
Please report it privately: on GitHub, open the repository's Security tab and choose Report a vulnerability. Don't open a public issue for it. Say what's affected, how to reproduce it, and what an attacker gains. We'll reply within a week and tell you what we'll do.
What counts
- A crash, hang or runaway memory use on any input file or website (never-crash is a hard rule: AGENTS.md).
- Code from a target running without the person's consent, or a tool doing more than its declared effects.
- A path that lets a coding agent act outside its project without approval.
- A key, token or other secret reaching a log, a tool's output, evidence or the repository.
- A plugin escaping its sandbox (WASM plugins import nothing; MCP plugins ask before each call).
Supported versions
Fixes go into the latest release.