Only the latest version receives security fixes.

Do not report in public Issues. Contact @TrueNine via GitHub Security Advisory or email.

Include: vulnerability description and impact scope, reproduction steps, environment info, fix suggestion (if any).

Maintainers are people, not a security team — no SLA. We'll confirm as soon as possible, fix within a reasonable timeframe, and disclose publicly after the fix. Do not push for urgency.

CLI / SDK / MCP / GUI toolchain. Security boundaries:

• Read: user .src.mdx source files, project config, global config (~/.aindex/.tnmsc.json), repo metadata required for sync
• Write: target tool config directories, managed prompt artifacts paired beside their source files, generated outputs
• Cleanup: erase managed outputs and residuals during sync or cleanup

Out of scope: vulnerabilities in target AI tools themselves, user prompt content compliance, hardening third-party dependencies outside this repo.

• Source and derivation separation — auditable and traceable
• Cleanup targets only managed outputs — no expanded deletion scope
• No hidden telemetry
• External network behavior must be explicit

AGPL-3.0. Commercial use violating the license will be pursued.