ContextForge is pre-1.0 software. Security fixes target the latest release.

Please do not open public issues for security vulnerabilities.

Use GitHub's private vulnerability reporting form. The form sends the report privately to the repository owner. If the form is not available, do not publish exploit details in an Issue; open a minimal public Issue asking for private vulnerability reporting to be enabled.

Include:

• affected version or commit;
• reproduction steps;
• impact assessment;
• any relevant logs or environment details without secrets.

The maintainer will acknowledge a report when practicable, investigate it, and coordinate disclosure and release timing with the reporter.

ContextForge does not execute repository content or provide source-write, shell, arbitrary-process, Git-mutation, worktree, or autonomous-agent tools. The scanner and CodeMap extractor read local files to classify, hash, and parse them without importing repository modules. Model-assisted analysis and discovery send bounded verified source/facts only to the explicitly configured provider. Packages, prompts, diffs, index interpretations, and stdout must be handled as sensitive copies or interpretations of repository data.

Repository paths in snapshots and packages are portable relative paths. Absolute, traversal, Windows drive-relative, and UNC-style selectors are rejected. Symbolic links and Windows directory junctions encountered below the repository root are not followed. Selected-file reads revalidate each path component, regular-file identity, size, and SHA-256 before content is accepted. JSON inspection is bounded and does not access paths named by a package.

ContextForge assumes the selected repository root and output destination are local paths the invoking user is authorized to read or write. A concurrently modified repository can cause a scan or package build to fail; run against a quiescent working tree when a reproducible snapshot is required. These portable checks reduce filesystem races but are not a sandbox boundary against another process with the same account continuously rewriting the tree.

Output parents must already exist. Package output is fully rendered before a sibling temporary file is atomically published. Existing destinations are refused unless the context or tree command is given --force.

The generated index uses immutable generations and an atomic active pointer. Only .contextforge/index is removed by index clean; user-authored .contextforge/config.toml, saved contexts, and runs are preserved. Index paths, record references, and every filesystem component are validated without following symlinks or junctions. Failed strict orchestration restores the prior active pointer when one existed.

Provider configuration contains endpoint/model policy and, optionally, an environment-variable name. It rejects inline credentials, sensitive query parameters, unknown fields, and non-local endpoints when local_only=true. When local_only=false, a remote endpoint is still rejected unless external_data_policy="allow_repository"; deny and allow_selected do not authorize remote transport in the current 0.4.x release. Repository-wide authorization can send any selectable snapshot file, including files with secret-like names, so users must review ignore rules and provider retention before enabling it. ContextForge does not claim complete secret detection. Credential values are resolved only at request time, redacted from typed errors, and forbidden from indexes, reviews, handoffs, prompts, and run data.

Structured diagnostics apply centralized field-aware redaction recursively. Authorization and proxy-authorization values, bearer tokens, API keys, passwords, cookies, access/refresh tokens, credential fields, URL user-info, and sensitive query parameters are replaced before serialization. Endpoint diagnostics contain only a sanitized origin/path. Repository paths are normally portable repository-relative paths. Complete prompts, source contents, request bodies, raw model output, response bodies, and credential values are not diagnostic fields. Debug/trace file stack traces use the same redaction and bounded causal-chain policy.

.contextforge/logs/ and .contextforge/runs/ are machine-local sensitive operational state and are covered by the protected/ignored .contextforge/ root. Do not publish them without review. A logging or run-summary write failure degrades diagnostics and must not alter an active operation or index generation.

The MCP server is local stdio and pins one validated repository snapshot/index generation per session. It delegates queries and reads to the same bounded discovery executor as in-process callers. It advertises only read-only tools and resources: no sampling, remote transport, subscriptions, source/index mutation, shell/process execution, Git mutation, or agent orchestration. Protocol output is isolated on stdout; diagnostics use stderr.

The ContextForge bridge is also a local stdio transport for trusted integrations, not a network service, sandbox, authorization layer, or multi-tenant boundary. The process inherits the invoking user's ability to read the bound workspace. Only launch clients you trust with repository excerpts, candidate metadata, index provenance, and context packages. Do not expose the bridge through a socket, web endpoint, shared pipe, privilege boundary, or untrusted process broker without adding authentication, authorization, isolation, and transport limits outside ContextForge.

Bridge v1 is model-free and has no network, provider, shell, subprocess, source-write, Git-mutation, or index-mutation capability. Its package operation returns an in-memory artifact and does not publish a file. snapshot, expected_snapshot_digest, per-file SHA-256 identities, stable source reads, and SOURCE_IDENTITY_CHANGED prevent stale or substituted excerpts from being accepted as current repository truth. They detect changes; they do not turn a hostile same-account process into a safe peer. Stdout is reserved for bounded JSON-RPC frames and bounded diagnostics use stderr; both can contain sensitive repository-derived information and must be protected accordingly.