Do not open a public GitHub issue for security reports.

Please report vulnerabilities privately via GitHub Security Advisories (preferred) or email:

1. Open https://github.com/orenlab/ckdn/security/advisories/new
2. Or email rozhnovskiydenis@gmail.com with subject [ckdn security]
3. Include: affected versions, reproduction steps, impact, and any suggested fix.

We aim to acknowledge reports within 7 days and to publish a fix or mitigation timeline once the issue is confirmed.

In scope:

• Remote or local code execution via crafted tool output / artifacts
• Path traversal via {run_dir} / config paths that escapes the intended workspace
• Secrets leaking into digests, logs, or published artifacts by default
• Privilege escalation when ckdn is used as a CI / hook gate

Out of scope (unless you can show a concrete exploit path):

• Misconfiguration of third-party tools that ckdn merely orchestrates
• Social-engineering agents into ignoring digests
• Denial of service by feeding unbounded tool output (digests are bounded; full.log is intentionally complete evidence)

• Treat .agent-runs/ as sensitive evidence (may contain secrets from tool stdout). Keep it out of version control and restrict access in CI artifacts.
• Prefer machine-readable reports written into {run_dir} over scraping terminals.
• Do not run untrusted check commands; ckdn.toml is trusted project configuration.
• Parser artifact paths (junit, report, etc.) are resolved with resolve() and must stay inside the run directory; absolute paths such as /etc/passwd, .. segments, and symlink escapes are rejected before any read (limits damage from a compromised agent editing check options).
• Command argv paths are confined to the workspace cwd by default; extend with command_policy = "off" only when you accept full subprocess scope. Commit ckdn.lock.toml and run ckdn verify-config --locked in CI when agents can edit ckdn.toml.