Security

SECURITY.md

Security Policy

BeforeShip is a security-adjacent project. Please report vulnerabilities responsibly.

Supported versions

The project is currently in early public planning/MVP stage. Security support will be formalized after the first implementation release.

Reporting a vulnerability

Please do not open a public issue for sensitive vulnerabilities.

For now, contact the maintainers privately or open a minimal GitHub issue that says you have a security report without including exploit details.

Scope

Security issues may include:

command injection in the CLI
unsafe handling of repository files
leaking secrets into reports
unsafe MCP tool behavior
prompt-injection issues that could cause destructive actions
dependency vulnerabilities

Project safety principles

BeforeShip should:

run locally by default
avoid uploading source code unless the user explicitly opts in
redact secrets from reports
never print tokens or .env values
avoid destructive actions
clearly separate scan, explain, and fix modes
require explicit user approval for any future auto-fix behavior

There aren't any published security advisories