Report suspected vulnerabilities through GitHub private vulnerability reporting. Do not open a public issue for a vulnerability or include sensitive details in an ordinary bug report.

Include the affected scalps version or commit, openSUSE Leap version, reproduction steps, expected impact, and any known workaround. Avoid attaching proprietary source code, compilation databases, indexes, credentials, or private paths unless the maintainers request them through the private report.

Before the first public release, only the current development revision is maintained. Beginning with 1.0.0, the latest released version will receive security fixes until a broader maintenance policy is published. Reports about unsupported environments are still useful when the same problem may affect the supported openSUSE Leap 16 environment.

Private vulnerability reporting must be enabled on the GitHub repository before its first public release.

scalps index and scalps status authorize GCC-compatible compiler wrappers so they can report their effective target and system includes. This is a deliberate trust boundary:

• Querying is off unless patterns come from --query-driver, <project-root>/.scalps/query-driver, or the Nix store default (every compilation driver resolves under /nix/store/, in which case those exact resolved paths are authorized and a note is printed). Use --query-driver none or a config line none to disable all of the above.
• auto authorizes only the exact resolved absolute paths of compilers already listed in the compilation database.
• Only the resolved, normalized path of a compilation-database driver is matched. Relative patterns are rejected.
• Authorized drivers run without a shell, with empty stdin, a timeout, and an output-size limit. Arbitrary project flags that could load plugins or redirect program search are not forwarded.
• An allowlist that matches no compilation command fails closed rather than appearing to enable discovery.
• Prefer auto or exact paths over broad globs. Patterns such as /nix/store/** or /** authorize any later matching path that appears in a compilation database.
• status does not reuse stored query results from a previous run. It re-resolves authorization from the same sources as index and re-queries when authorized. Missing authorization yields unknown freshness instead of implicit execution.

Treat compilation databases, project query-driver config, and allowlist patterns as sensitive configuration: they influence which local executables scalps may run.