mirror of
https://github.com/storytold/craft-anything.git
synced 2026-11-05 20:47:45 +01:00
Brandon Thomas
f64ae3bf3c
A native, pure-Rust app that shows anyone how a piece of software works, with evidence-backed answers, then helps them rebuild it. It ships a desktop app, a CLI and an MCP server, all driven by one engine. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
24 lines
980 B
Markdown
24 lines
980 B
Markdown
# Security
|
|
|
|
Craft Anything reads hostile files and runs other programs, so we take reports seriously.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please report it privately: on GitHub, open the repository's **Security** tab and choose
|
|
**Report a vulnerability**. Don't open a public issue for it. Say what's affected, how to reproduce
|
|
it, and what an attacker gains. We'll reply within a week and tell you what we'll do.
|
|
|
|
## What counts
|
|
|
|
- A crash, hang or runaway memory use on any input file or website (never-crash is a hard rule:
|
|
[AGENTS.md](AGENTS.md)).
|
|
- Code from a target running without the person's consent, or a tool doing more than its declared
|
|
effects.
|
|
- A path that lets a coding agent act outside its project without approval.
|
|
- A key, token or other secret reaching a log, a tool's output, evidence or the repository.
|
|
- A plugin escaping its sandbox (WASM plugins import nothing; MCP plugins ask before each call).
|
|
|
|
## Supported versions
|
|
|
|
Fixes go into the latest release.
|