CLIarity is a security-sensitive application that handles system paths, executable discovery, and diagnostic data. We take security seriously.

Please do not report security vulnerabilities through public GitHub issues.

Report them privately through GitHub Private Vulnerability Reporting, which is enabled on this repository:

1. Go to the Security tab.
2. Choose Report a vulnerability.
3. Fill in the advisory form.

This creates a private security advisory visible only to you and the maintainers. No GitHub App, email address, or account beyond your own GitHub login is required.

Include:

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Any suggested fixes

CLIarity is maintained by a single person as an unpaid side project, so no response-time guarantee is offered. Reports are read and triaged as soon as is practical. If a report goes unacknowledged for an extended period, feel free to add a comment on the advisory as a reminder.

CLIarity operates in read-only mode and follows these security principles:

• Discovers tool executables via PATH scanning
• Runs version commands with strict timeouts
• Exports sanitized diagnostic reports (paths redacted, no secrets)
• Displays results in a local desktop UI

• Modify PATH or system configuration
• Read credential stores, API keys, or .env files
• Construct user-controlled shell command strings (see Security Measures below)
• Install or modify software
• Send data to remote servers
• Store or log secrets

• Vulnerabilities in detected third-party tools (report to those projects)
• Windows OS vulnerabilities
• Issues requiring privileged access CLIarity doesn't request

• No user-controlled shell strings: CLIarity never constructs shell command strings from user input or tool output. Commands are resolved to absolute paths and invoked with static, separately supplied arguments. Windows .cmd and .bat execution may internally use the Windows command processor through Rust's protected batch-script handling.
• Timeout enforcement: 5-second cap on external commands
• Output size limits: 64 KiB retained per stream to prevent memory exhaustion
• Path sanitization: Usernames redacted in exports (C:\Users\alice\... → %USERPROFILE%\...)
• Allowlist exports: Only known-safe fields exported, never raw stdout/stderr
• No secret reads: Explicit deny rules for .env, credentials, tokens

• PATH hijacking: CLIarity reports the first executable found in PATH. If an attacker controls an earlier PATH directory, they can shadow legitimate tools. This is a general Windows security issue, not specific to CLIarity.
• Version string trust: Parsed versions come from tool output and are not cryptographically verified.

See docs/THREAT-MODEL.md for detailed security analysis.

Security fixes will be released as patch versions. Users should update promptly when notified of security releases.