The latest GitHub Release receives security fixes. Version 0.1.x is the current supported line.

Use GitHub's private vulnerability reporting for this repository. Do not open a public issue for an unpatched vulnerability. Include the affected version, a minimal synthetic flag file, impact, and reproduction steps. Do not include provider credentials or production audience data.

Flagfold accepts an untrusted local JSON file and writes reports to stdout. It does not use a network, provider SDK, shell command, template engine, database, or dynamic code evaluation.

Relevant abuse cases and controls:

• Oversized input: files larger than 5 MiB are rejected before parsing.
• Combinatorial denial of service: the exact context product is calculated before enumeration and capped at 100,000 by default.
• Malformed or adversarial expressions: boundary validation accepts only the documented single-operator JSON objects and fails on unsupported semantics.
• Secret disclosure: reports contain attribute names and witness values derived from the supplied rules. Do not analyze production files whose literals are secrets; Flagfold cannot know which business values are sensitive.
• Terminal control injection: JSON string values are emitted through JSON encoding rather than interpreted as markup or commands.

Dependency audits identify known advisories but do not prove safety. Flagfold keeps the runtime dependency-free; release CI audits the locked development/build environment.