# Security

## Release status

Version 0.2.0 is the initial public GitHub release. There is no long-term support or response-time guarantee.

## Report a vulnerability

Do not put credentials, original session logs, prepared source snippets or other sensitive evidence in a public issue.

Use GitHub's private **Report a vulnerability** option if it is available. If private reporting is unavailable, ask the repository owner for a private contact channel without posting the sensitive details. The owner profile is [MircoBlitz](https://github.com/MircoBlitz). This document does not claim that private reporting is already enabled.

A useful private report identifies the affected version, describes the impact and gives a minimal reproduction using synthetic data. Remove secrets and identifying details before sharing files.

## Session data and extension permissions

Pi extensions run with the same operating-system permissions as Pi. Miner is not a sandbox. It reads selected historical sessions and writes run files in the chosen workdir; loading a third-party extension requires trust in its source.

Session logs and generated evidence packets can contain secrets, personal data, private source code and absolute filesystem paths. Miner does not promise automatic redaction. Keep run directories private and review them before passing them to a model, worker or another person. Provider handling depends on your Pi configuration.

Filesystem permissions and read-only source handling do not prove human consent, semantic correctness, safe model output or absence of sensitive information. Follow-up changes need their own authorization.