Security reports must use a private channel. Submit a private GitHub security advisory with:

• The affected component and version or commit
• Reproduction steps or a proof of concept
• The expected impact
• Any suggested mitigation, if known

Do not disclose a suspected vulnerability in a public issue, discussion, pull request, or other public channel. If GitHub does not offer the private advisory form to you, do not post the report publicly; ask a project maintainer through a private GitHub mechanism to open an advisory and invite you as a collaborator.

The maintainers will acknowledge reports through the advisory, investigate them, and coordinate remediation and disclosure there. Response and resolution times depend on severity and project availability, so no fixed service-level commitment is promised.

Reports about the Neuroshift Engine source and its first-party deployment configuration are in scope. Vulnerabilities in third-party providers should be reported to the relevant provider unless Neuroshift uses the dependency in an independently unsafe way.

Never include real customer data, production credentials, or unnecessary personal data in a report.

No versioned public release exists yet. Security fixes are applied to the current main development line once it is published; older commits and development branches are not supported releases.

Local autonomous file mutation and argv execution are experimental. neuroshift run defaults to observe-only read and Git tools; explicit workspace permission adds guarded mutation plus canonical command.run and test.run. Schema, capability, permission, task-local one-shot approval, fingerprint, command-policy, and resource-limit checks are defense in depth, not containment. The retained neuroshift exec directly exposes one user-supplied argv command under the same host supervisor.

A workspace working directory is not a sandbox. Local execution does not prevent absolute filesystem access, subprocesses, IPC, syscalls, or network activity available to the host account. Tests and other allowed development tools are programmable. A deliberately evasive descendant can leave its process group; reliable containment and cleanup require a cgroup, container, or equivalent OS boundary. Pattern-based output redaction cannot prove all secrets are removed. There are no dedicated Git stage/commit/push, browser, sudo, desktop, shell-string, or raw hosted-sandbox tools, although allowed programmable commands can still have broad effects; command policy specifically blocks git push and sudo. Use deployment-controlled isolation and network policy for untrusted commands. See Local Execution Security and Autonomous Runtime.

Custom provider endpoints, URL fetching, search-result fetching, and webhooks cause server-side outbound requests. Private provider endpoints are denied by default. Enabling private or LAN provider endpoints weakens SSRF protection and must be limited to a trusted development or administrator-controlled environment.

The private GitHub advisory channel must be enabled and tested by a maintainer before the repository is made public. Previously committed credentials must be rotated independently of repository cleanup.