Security fixes are applied to the latest release on the default branch.

Please use GitHub private vulnerability reporting when it is available for this repository. Do not open a public issue for a vulnerability that could expose user data or enable code execution.

Include:

• A concise description
• Reproduction steps
• Affected files or commands
• Expected impact
• A safe test case when possible

The Python scanner parses source with the standard library AST module. It does not import or execute the analyzed project.

The hosted workbench processes the sample source in the browser and does not persist it. Do not paste secrets or proprietary source into any hosted development tool without confirming your organization's policy.

The CLI migrate --write command changes the selected file after the patch contract passes. Review the diff and use source control before enabling write mode.

The enterprise demonstration loads only checked-in JSON and Markdown fixtures under fixtures/enterprise. It does not fetch contracts from arbitrary URLs.

Python source fixtures are parsed with ast. They are never imported, evaluated, compiled for execution, or run as part of analysis. Generated test source is displayed and syntax-checked but not executed against an untrusted project.

The over-broad candidate is an intentional local test hook. It demonstrates that the verifier rejects an unrelated file change. It is not applied to the working tree.

Report hashes provide deterministic integrity evidence for this demonstration. They are not digital signatures and do not establish authorship or runtime correctness. See security and non-execution.