# Security Policy

## Reporting a vulnerability

To report a security issue, email **security@iriscode.co** or open a
[GitHub issue](https://github.com/Daiveedjay/Iris-VSCode-Extension/issues) marked **[security]**.
We aim to respond within 48 hours.

## What the CLI does on your machine

### Network requests

`@iris-code/cli` makes outbound HTTPS requests only. No source code is ever transmitted.

| Endpoint | Command(s) | Purpose |
|---|---|---|
| `api.iriscode.co` | All commands on startup | Licence validation |
| `registry.npmjs.org` | `iris deps` | Fetch latest npm package versions |
| `pypi.org/pypi` | `iris deps` | Fetch latest PyPI package versions |
| `proxy.golang.org` | `iris deps` | Fetch latest Go module versions |
| `api.github.com/graphql` | `iris deps` | CVE lookups via GitHub Advisory Database |
| `iriscode.co/cli-auth` | `iris auth login` | Browser-based authentication redirect |

All requests use TLS. The GitHub Advisory API call includes a `User-Agent: iris-cli` header
and, optionally, a GitHub PAT for higher rate limits.

### Files written to disk

| Path | Created by | Contents | Permissions |
|---|---|---|---|
| `~/.iris/credentials` | `iris auth login` | Licence token and optional GitHub PAT (JSON) | `0600` |
| `.iris-cache/dependents.json` | `iris deps` | Cached dependency scan results, expires after 24 h | default |
| `.git/hooks/pre-push` | `iris hook git install` | Shell script that calls `iris check` before push | `0755` |
| `package.json` (prebuild) | `iris hook build install` | Adds `prebuild` script entry (Node projects) | unchanged |
| `Makefile` (iris-check target) | `iris hook build install` | Adds `iris-check` phony target (Go/Python projects) | unchanged |

`.iris-cache/` is automatically added to `.gitignore` on first write so cached data is
never accidentally committed.

### Environment variables read

| Variable | Purpose |
|---|---|
| `IRIS_LICENCE_TOKEN` | Licence key - takes priority over `~/.iris/credentials` |
| `GITHUB_TOKEN` | GitHub PAT for higher Advisory API rate limits |

### What never leaves your machine

- Source code (all analysis runs entirely locally)
- File contents of any kind
- Dependency version data beyond the package names already in your manifest
- Anything written to `.iris-cache/`

## Supply chain

`@iris-code/cli` is published as a single self-contained bundle (`dist/cli.js`) built
with [esbuild](https://esbuild.github.io/). The bundle includes
[@clack/prompts](https://github.com/bombshell-dev/clack) for interactive prompts and
the Iris core analysis engine. No other runtime dependencies are installed alongside
the package.

The source repository is
[Daiveedjay/Iris-VSCode-Extension](https://github.com/Daiveedjay/Iris-VSCode-Extension).