SECURITY.md

Security policy

Reporting a vulnerability

Open a private security advisory on GitHub. Please do not open a public issue for a vulnerability.

Expect an acknowledgement within a week.

Threat model

portdiff reads local system state and writes two files. It is often run as root, so the things worth reporting are:

• Anything that turns parsing untrusted input into code execution or a crash loop. ss output, /proc contents and the ledger file are all treated as untrusted text; the parsers skip what they do not understand rather than throwing.
• Anything that leaks the contents of baseline.json or events.jsonl, since they are written 0600 and can contain command lines.
• Anything that causes the tool to write outside its state directory, or to execute a command built from collected data.
• Anything that sends data off the machine without the operator opting in, or that gets a credential past src/llm/redact.js into an outbound prompt. A concrete command line that survives redaction is a useful report. Please include it.

Out of scope: the tool reporting a port you consider uninteresting, and the fact that a webhook you configured sends data to the endpoint you configured.

Supported versions

The latest released minor version.