If you discover a security vulnerability in Minta, please report it privately via:

• Email: [xxinchen03@gmail.com]
• GitHub Security Advisory: Use the "Report a vulnerability" button on the Security tab

Please do not open a public issue.

• A clear description of the vulnerability and its impact
• Steps to reproduce (proof-of-concept code, screenshots, or logs)
• Affected versions (if known)
• Any suggested mitigations

We will keep you informed of progress throughout the process. If we believe the vulnerability is a duplicate or out of scope, we will explain our reasoning.

We ask that you:

• Do not publicly disclose the vulnerability until we have released a fix and published a security advisory
• Give us reasonable time to investigate and patch before the 30-day window expires
• Delete any sensitive data obtained during research once the issue is resolved

We are happy to credit you in the advisory (with your permission) and link to any write-up you publish after the fix is released.

Minta is a local-first personal context layer. The following are in scope:

• RCE, arbitrary file read/write via the Data API (port 8772), Autopilot (port 18730), or MCP HTTP endpoint (port 18721)
• Authentication bypass, privilege escalation
• SQL injection, command injection
• Sensitive data exposure (API keys, credentials in logs/configs)
• Cross-origin attacks affecting the local dashboard

• Attacks requiring physical access to the user's machine
• Social engineering
• Denial-of-service against localhost services
• Issues that require the attacker to already have shell access on the host

Only the latest release receives security patches. We recommend always running main or the most recent tagged release.