Plumbline is a research/prototype tool. If you find a security issue, please open a GitHub issue or contact the maintainer directly rather than disclosing it publicly first.

• reanchor --approver checks org-chart membership against the anchor's org_chart_path, not a cryptographic signature from that approver. Any caller who can invoke the CLI can claim to be a given approver name. A production integration should require the approver's own signing key, the same way anchor-create requires the issuer's key to sign the anchor itself.
• The bundled LexicalDriftScorer is a bag-of-words heuristic, not a semantic model. It can be evaded by an agent that pads its heartbeat text with goal-related keywords while doing unrelated work (keyword stuffing). It composes with, but does not replace, an authorization/policy layer for actually-adversarial agents.
• The drift ledger is tamper-evident (modifications are detectable), not tamper-proof (nothing stops someone with write access to the ledger file from replacing it wholesale with a different, internally-consistent chain). Ship the ledger to write-once/append-only storage for real tamper resistance.