Security policy

Reporting a vulnerability

Please report security issues privately through GitHub's private vulnerability reporting. Do not open a public issue for a vulnerability.

Include what you found, how to reproduce it, and the version or commit you tested. You will get an acknowledgement within five working days.

Archer deploys changes to real infrastructure, so we treat these as security issues:

anything that lets a principal act beyond its role or token scopes;
any path by which a secret value reaches the browser, a log, an event stream, the audit log or an export;
bypasses of plan review, approvals, locks or rollback;
injection through documents, pack metadata or live data (HTML, script, expression or command injection);
anything that makes Archer listen on a non-loopback address without authentication.

Archer is pre-release. Security fixes land on main and in the next release.