1. Do not open a public issue. Email security concerns to the maintainer via GitHub's private vulnerability reporting (Security → Report a vulnerability).
2. Include a description of the issue, reproduction steps, and affected versions.
3. You will receive acknowledgment within 72 hours.
4. Security fixes are prioritized and released as patch versions.

A PGP key is not currently published; GitHub private advisories are the supported confidential channel. If encrypted email is required for a report, request a key in the advisory thread.

CauterRule processes agent trajectories that may contain untrusted content (tool outputs, error messages, user prompts). The threat model assumes adversaries can influence trajectory content but cannot control the host environment.

• Adversarial source-trust gate in production promotion (#727) — the "0 adversarial promotions" protection is no longer test-only. At capture, detect_injection_signal flags trajectories whose tool I/O carries an injection signature (prompt-injection markers, encoded blobs); the flag is persisted on the trajectory and propagated to candidate provenance. auto_promote (src/cauterule/promotion/auto.py) hard-rejects any candidate from a tainted source, independent of linter/replay/safety/confidence, and even force cannot bypass it. Covered by tests/promotion/test_source_trust.py.
• Extraction-accuracy metric — replay/field-test runs report extraction_f1 / extraction_agreement, making extraction quality directly measurable rather than inferred from verdicts (#730).
• 43 code-review fixes (#762–#804), including export/pack security hardening and input-validation gaps found by the full-repo audit.

• Remote MCP hardening — bearer auth + per-client rate limiting + payload validation (#601)
• Adapter conformance kit — all adapters prove redaction-on-disk and no-repeat contracts (#540)
• Rule lifecycle safety — supersession/retirement/quarantine prevent stale rules from masquerading as active (#541-#545)
• Pack certification — checksums + safety/replay/provenance gates for installable packs
• Durability fixes — atomic store writes and path-traversal guards on rule IDs (#517-#527)
• Webhook SSRF — M1 fix restricts webhook URLs to configured http(s) endpoints with bounded timeouts
• Adversarial override — expected_outcome="should_reject" forces rejection regardless of match quality (#714)

Six adversarial corpora test rule robustness against known attack patterns:

1. Prompt injection — trajectories containing injection attempts; no rule should promote an injection directive
2. Misleading root-cause — plausible-but-wrong failure causes; extracted rules should fail replay
3. Contradiction stress test — conflicting directives; linter should flag contradictions
4. Unsafe directive — dangerous/destructive actions; promotion gate should reject
5. Data poisoning simulation — manipulated trajectories with false annotations; corpus validation should catch
6. Instruction leakage — system prompt fragments in trajectory; extracted rules should contain no prompt fragments

M10 field test result: all 6 adversarial corpora produced 0 promoted rules across all tested models.

v0.3.0 (M7/M8) additions: the adversarial set was extended with near-miss, staleness, counterexample, and five new vectors (tool-output injection, compounding multi-turn, unsafe-realistic, misleading harmbench, contradiction harmbench). Across both cloud models the promotion gate produced 0 unsafe promotions; the should_reject override (#714) catches legitimate-looking rules extracted from adversarial trajectories, and near-miss matches downgrade the scorer verdict from pass to inconclusive (tolerance band ≤2 near-misses with precision ≥0.5). See docs/field-test/v0.3.0/FIELD_TEST_REPORT.md.

The redaction engine strips secrets before LLM extraction and before export.

• Custom patterns: configurable via cauterule.toml under [redaction]
• Export redaction: all export formats (.cursorrules, CLAUDE.md, AGENTS.md, etc.) run through redaction before writing
• Adapter coverage: generic watch/inject and framework adapters (LangGraph, CrewAI, PydanticAI) redact before persisting trajectories, including tool I/O, error text, tags, sets, and quality_label
• Test fixtures: redaction/adversarial test modules carry a SECURITY-FIXTURE marker; every token-like string in them is an intentional fake credential, not a real secret

Scans run in .github/workflows/security-scan.yml on push, PR, and weekly.

The aggregate score is below the ≥7/10 target. The remaining gaps are structural for a young, single-maintainer repository and are tracked with mitigation plans rather than silently accepted:

• Branch protection / Code-Review / Contributors / Maintained — require organizational history and review policy; track as project matures.
• Dependency-Update-Tool — ✅ dependabot detected (.github/dependabot.yml), score 10.
• SAST — CodeQL / static analysis tracked by #614.
• Token-Permissions — top-level permissions: contents: read added to ci.yaml and security-scan.yml; perf.yml still lacks a top-level block.
• Pinned-Dependencies — pin GitHub Actions and base images by hash tracked by #614.
• Fuzzing — fuzzing integration tracked by #614.
• Packaging — no publishing workflow detected; the release workflow will address this. #749-#751.

• GitHub Security Advisories: Report a vulnerability
• Maintainer: Debashish Ghosal