codexa is currently in early development. All 0.x releases receive security patches. Once we reach 1.0, this table will be updated.

Please do NOT open a public GitHub issue for security vulnerabilities.

If you found a security issue, report it privately:

Use GitHub's built-in private reporting:
Security → Report a vulnerability (button on the repo page)

This keeps the details private until a fix is released.

Send details to: evrey2696@gmail.com
Subject: [codexa] Security vulnerability

Encrypt with PGP if possible (key: add your PGP key or keybase link here).

A good report helps us fix the issue faster:

• Description — what the vulnerability is
• Impact — what an attacker could do with it
• Steps to reproduce — minimal example or proof of concept
• Affected versions — which version(s) you tested
• Suggested fix — if you have one (optional but welcome)

If a vulnerability is declined (not a real issue or out of scope), we'll explain why within 7 days.

Issues we consider in-scope:

• Code execution via crafted project files (e.g. malicious codexa.toml)
• Path traversal when scanning project directories
• Credential leakage (API keys written to logs or temp files)
• SQLite or PostgreSQL injection in the vector store
• Malicious ONNX model loading via local-embed feature

Out of scope:

• Vulnerabilities in your OS or Rust toolchain itself
• Issues requiring physical access to the machine
• Social engineering

Security researchers who responsibly disclose issues will be credited in the release notes and in CONTRIBUTORS.md (with their permission).

We don't have a bug bounty program yet, but we appreciate every report.