# Security Policy

## Supported versions

Only the newest published prerelease is supported while the project is in Alpha. Compatibility is limited to the exact DSH and Cordis versions declared by that release.

| Version | Status |
| --- | --- |
| `0.0.1-alpha.0` | Current supported npm prerelease |
| `0.1.0-alpha.1` | Unreleased development version |

## Reporting a vulnerability

Use the public repository's private vulnerability-reporting channel when available. If it is unavailable, contact the maintainer privately through the GitHub profile rather than opening a public issue. Do not disclose a vulnerability, private Tool Schema, credential, or user query publicly.

Include the affected version, deployment mode, impact, minimal reproduction, and whether the issue crosses an Agent scope or tool-execution boundary. Maintainers will acknowledge the report, assess it, and coordinate a fix and disclosure timeline.

## Security boundaries

The following boundaries describe the unreleased `0.1.0-alpha.1` development version. They become supported-release guarantees only after that version is published.

`0.1.0-alpha.1` only reads model-visible Tool Schemas and returns ranked metadata. It does not activate, authorize, or execute matched tools. Tool permissions remain owned by DSH and the original tool providers.

When the catalog reaches `rewrite.minCatalogSize`, the original user query may be sent to the configured DSH provider/model, or to the calling Agent's route when no override is configured. Tool names, descriptions, schemas, credentials, and lexical results are not included in that auxiliary request. The query is untrusted data: the system prompt forbids following payload instructions, no tools are supplied, and only one strict bounded JSON field is accepted. The selected DSH provider still owns transport, retention, and credential policy.

Dense is disabled by default. If an operator explicitly installs the optional Transformers.js peer and enables Dense, the first Dense search may download pinned model files over HTTPS from Hugging Face and persist them in `dense.cacheDir`. Use `dense.offline: true` after provisioning the cache for a network-isolated deployment. Treat the cache as executable model supply-chain input: restrict write access, retain the pinned revision, and do not share an untrusted cache directory between tenants.

## Known dependency advisories

As checked on 2026-08-14, enabling the optional pinned Transformers.js peer introduces high-severity transitive advisories: `onnxruntime-node` includes `adm-zip` affected by `GHSA-xcpc-8h2w-3j85`, and Transformers.js includes `sharp` affected by `GHSA-f88m-g3jw-g9cj`. npm reported no available fix for that experimental dependency graph.

Those packages are not required by the default consumer path. An operator enabling Dense must explicitly accept and re-audit them; passing retrieval tests does not waive the findings.