We release patches for security vulnerabilities for the following versions:
| Version | Supported |
|---|---|
| 0.3.x | ✅ |
| 0.2.x | ✅ |
| < 0.2 | ❌ |
We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.
Please do NOT report security vulnerabilities through public GitHub issues.
Instead, please report them via email to: security@pisama.ai
Include the following information:
- Description of the vulnerability
- Steps to reproduce the issue
- Affected versions
- Potential impact (what could an attacker do?)
- Any suggested fixes (optional)
- Acknowledgment: We will acknowledge receipt within 48 hours
- Assessment: We will assess the vulnerability and determine severity within 7 days
- Updates: We will keep you informed of our progress
- Resolution: We aim to release a fix within 30 days for critical issues
| Level | Description | Target Resolution |
|---|---|---|
| Critical | Remote code execution, credential exposure | 7 days |
| High | Privilege escalation, data exposure | 14 days |
| Medium | Limited data exposure, DoS | 30 days |
| Low | Minor issues | Next release |
pisama-claude-code captures traces from Claude Code sessions. By default:
- Traces are stored locally in
~/.claude/pisama/traces/ - Secrets are automatically redacted (API keys, passwords, tokens)
- File paths are anonymized (home directory replaced with
~) - Platform sync is opt-in - traces are never uploaded without explicit action
The following patterns are automatically redacted:
- API keys (various formats)
- Passwords and tokens
- AWS credentials
- Private keys
- Database connection strings
If you find that sensitive data is not being properly redacted, please report it as a security issue.
The capture hooks run with your user permissions. They:
- Only read data that Claude Code provides
- Do not execute arbitrary commands
- Do not modify your files or system
When syncing to the PISAMA platform:
- All communication uses HTTPS
- Authentication uses secure tokens
- Data is encrypted in transit
- Keep updated: Always use the latest version
- Review traces: Periodically check what's being captured
- Limit sync: Only sync to the platform when needed
- Secure storage: Protect
~/.claude/pisama/directory permissions
We appreciate responsible disclosure and will acknowledge security researchers who report valid vulnerabilities (with their permission).
- Security issues: security@pisama.ai
- General questions: team@pisama.ai