We take the security of the Cendor projects seriously. Thank you for helping keep them and their users safe.
Please do not open a public issue for security problems.
Report vulnerabilities privately through GitHub Private Vulnerability Reporting: open the
Security tab of the affected repository (e.g.
https://github.com/cendorhq/cendor-libs/security/advisories/new) and choose Report a
vulnerability. This creates a private advisory only the maintainers can see, and lets us
collaborate on a fix and coordinate disclosure with you.
If Private Vulnerability Reporting is not enabled on a given repository, open a draft security
advisory on any Cendor repository under cendorhq and we will route it.
Please include, where you can:
- the affected package(s) and version(s),
- a description of the issue and its impact,
- steps to reproduce or a proof of concept,
- any known mitigations.
These are local-first libraries — they run in your process, with no Cendor-operated servers or
network services. That shapes the threat model: there is no hosted endpoint to attack. Relevant
classes of issues include, for example, redaction bypasses in acttrace, incorrect budget
enforcement in tokenguard, unsafe deserialization of cassettes, or audit-chain verification flaws.
acttrace produces evidence to support a compliance case — it is not a compliance guarantee.
- We aim to acknowledge a report within a few business days.
- We'll work with you on a fix and a coordinated disclosure timeline, and credit you in the advisory unless you prefer to remain anonymous.
Fixes land on the latest released minor of each affected package. Because versions are independent across languages, a fix may ship on different version numbers in Python and TypeScript.