Please do not open a public issue for security vulnerabilities.

Use GitHub Security Advisories, which keeps the report private until a fix is available.

Include where you can:

• Component affected (safety gate, path validation, provider layer, …)
• A reproducing input — a message payload, file path, or config
• The behaviour you observed and the behaviour you expected
• Impact: does it cause a false negative (dangerous message delivered) or a false positive (legitimate message suppressed)?

We will credit you in the advisory unless you prefer otherwise.

In scope — high severity

• Any input that causes a credential-solicitation message to be routed notify or digest instead of mute
• A prompt injection that changes the routing decision
• Path traversal escaping the dataset directory
• Secret leakage into logs, output, or prompts
• Bypass of the safety lock on the LLM arbitration path

In scope — moderate

• CSV formula injection in emitted output
• Resource exhaustion via crafted media or text
• PII appearing unredacted in log sinks

Out of scope

• Lexicon gaps for languages we do not claim to cover (see docs/SECURITY.md §Known limitations) — these are known limitations. A demonstrated bypass in a covered language is in scope.
• Vulnerabilities in optional third-party dependencies — report upstream, and tell us so we can pin or mitigate
• Findings that require an attacker to already control the config file or environment

Detection is evadable; the architectural control is not. Safety-locked decisions never reach the language model, so a prompt cannot unmute a scam even if every detection pattern is bypassed.

Full threat model, OWASP LLM Top 10 review, and adversarial results: docs/SECURITY.md.