cc-safety-net only. If you use an older version, upgrade and reproduce the issue there before you report it.
For what CC Safety Net protects and trusts, see Security model. The canonical policy is SECURITY.md in the source repository.
Report a vulnerability privately
Do not report security vulnerabilities in public GitHub issues. Use GitHub private vulnerability reporting for the repository when available. If that is unavailable, email the maintainer at jliew@420024lab.com. Include this information when it is safe to share:- The affected
cc-safety-netversion - Your operating system and runtime version
- The affected integration, such as Claude Code, OpenCode, Gemini CLI, GitHub Copilot CLI, Grok Build, Factory Droid, Devin CLI, or Codex
- Steps to reproduce, and the command or input that bypasses, weakens, or abuses CC Safety Net
- Any relevant output from
cc-safety-net explainorcc-safety-net doctor - Whether the issue can cause data loss, command execution, secret exposure, or another concrete security impact
explain and doctor output keeps paths and hostnames, so read Before you share a trace first.
Choose a public or private report
Ask one question. Did the tool fail to stop a destructive command, or did the tool itself cause the harm? A command CC Safety Net should have blocked is a bug for a public GitHub issue. The strict and paranoid threat model already assumes an attacker can make an agent emit any destructive command, so publishing “this command shape is not caught” gives an attacker nothing new. A public report gets the gap fixed faster and lets other users add a custom rule in the meantime. If the tool itself disclosed a secret its caller did not already hold, wrote a file outside its own directory, or shipped a tampered package, report a vulnerability privately.What counts as a security issue
Report these privately:- Disclosure of a secret the tool call did not supply, such as file contents or environment values the tool read, through block messages, audit logs, diagnostics, or debug output
- A false-positive report prefill that carries a path the report preview claims to have replaced
- A path traversal or filesystem issue in audit logging or configuration handling, where crafted input writes outside the intended directory
- A supply-chain or packaging issue affecting the published npm package or plugin distribution, including rulebook integrity
What belongs in public issues instead
Use normal GitHub issues for:- Any bypass or fail-open that lets a destructive command execute. This includes a coverage gap for a command the rules do not block yet, a parser, tokenizer, or wrapper-analysis edge case, or an analysis error that allows a command instead of blocking it. Report the command shape, not a ready-to-paste weaponized prompt-injection payload.
- A redaction gap, meaning a credential form the redactor does not recognize or a field it does not cover, when the value came from the tool call itself and appears only in the denial message returned to that caller or in the local audit log
- False positives where a safe command is blocked
- Missing convenience rules or new feature requests
- Documentation bugs
- Installation problems without a security impact
- Questions about custom rules or configuration
A destructive-command coverage gap stays public even when it looks severe. The maintainer does not reclassify it as a vulnerability. Use the private path only for the categories listed above. A command allowed under standard mode’s documented relaxations is not a gap. Standard is best-effort, while strict and paranoid fail closed on those forms.