CodeCouncil is pre-1.0 and alpha. Fixes land on main; there are no backported release branches yet.

Please do not open a public issue for a security problem.

Report it through GitHub's private vulnerability reporting: go to the Security tab and choose Report a vulnerability. That opens a private advisory visible only to the maintainers.

Please include, as far as you can:

• what an attacker gains (read a file, run a command, exfiltrate a key),
• the affected component (repo_scanner, an agent adapter, the dashboard, the MCP server),
• a minimal reproduction, and
• the version or commit you tested.

You should get an acknowledgement within a week. Since this is a single-maintainer hobby project, please treat that as a best effort rather than a guarantee. If a report is valid, we will agree a disclosure timeline with you before publishing.

CodeCouncil orchestrates autonomous coding agents over a repository you point it at. Some behaviour that looks alarming is working as documented — the Security section of the README describes the intended trust model. It is worth reading before reporting.

In scope — please report these:

• Reading a file that SENSITIVE_FILE_PATTERNS is supposed to exclude, by any route (scanner, agent tool call, prompt, or error message).
• Escaping the scanned repository root — path traversal, symlink escape, or writing outside it.
• Remote code execution, or a dependency resolving to a package the project does not control.
• Anything reachable on the dashboard beyond running the council itself, or that turns a loopback-only assumption into a remote one.
• Leaking API keys into logs, output, disk, or a model prompt.

Out of scope — these are known and documented:

• Agents execute autonomously. The Codex agent runs its CLI with --full-auto. That is the point of the tool.
• Repository contents are sent to model providers. That is the point of the tool. Review what you scan.
• Prompt injection from scanned code steering an agent. Untrusted repo content reaching an autonomous agent is inherent to the design; sandbox accordingly. A specific injection that defeats a control we claim to enforce (say, extracting an excluded credential file) is in scope.
• The dashboard has no authentication. It binds to 127.0.0.1 and warns when bound wider. Exposing it deliberately is a deployment choice.
• SENSITIVE_FILE_PATTERNS matching on filename only, so a non-obvious name such as config/prod.yaml is not excluded. It is a safety net, not a guarantee — see the README.