# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in SecretSage, please report it
privately. **Do not file a public GitHub issue for security vulnerabilities.**

Preferred channels:

1. **GitHub Security Advisory**: open a private advisory at
   <https://github.com/CycleCoreTech/secretsage/security/advisories/new>.
2. **Email**: `security@cyclecore.ai` with a clear description and
   reproduction steps.

We aim to acknowledge reports within 5 business days and to publish a
remediation or assessment within 30 days for valid findings.

## Supported versions

| Version | Supported |
| ------- | --------- |
| 0.5.x   | ✓ — current |
| 0.4.x   | partial — vault storage is byte-clean across all 0.4.x versions, but `secretsage get NAME` default mode renders a labeled `"  KEY: value"` form that is unsafe to pipe. Upgrade to 0.5.0+ for the stderr warning when default mode is piped. |
| < 0.4   | not supported — please upgrade |

## Threat model and current scope

SecretSage encrypts credentials at rest using `age` (X25519 +
ChaCha20-Poly1305). The vault is local to the host. The threat model in
scope for v0.5.x is:

- **In scope:** confidentiality of stored credentials at rest; integrity of
  the encrypted vault file; correctness of the credential-capture and
  retrieval pipelines (no display-side leakage that breaks downstream tools).
- **Out of scope (current release):** side-channel resistance (timing,
  present-vs-missing); memory hygiene (Node string lifecycle in process
  inspection); CMVP/FIPS validation (we use NIST-standardized algorithms but
  are not CMVP-validated); multi-device sync and identity backup/recovery
  beyond user-managed copies of `.secretsage/identity.txt`.

Issues outside the in-scope items are still welcome reports — they may be
deferred to a hardening sprint rather than patched immediately.

## Known transitive dependency advisories

The `inquirer@8.x` line we depend on transitively pulls in `lodash@4.17.21`,
which has open advisories (GHSA-xxjr-mmjv-4gpg, GHSA-r5fr-rjxr-66jc,
GHSA-f23m-r3pf-42rh). The vulnerable code paths (`_.template`, `_.unset`
prototype pollution) require attacker-controlled input that SecretSage does
not pass to these functions. We track this in the v0.5.1 dependency-update
sprint; users can apply `npm overrides` locally if their own threat model
requires immediate mitigation.

`yaml@2.x` has GHSA-48c2-rrv3-qjmp (stack overflow on deeply nested YAML).
SecretSage parses its own configuration files only, never user-supplied
YAML. Same v0.5.1 update window.