Only the latest minor release of caveat-cli on npm is supported. Report issues against that version; older releases are not patched.

Please open a private security advisory on GitHub: https://github.com/kitepon/Caveat/security/advisories/new

Do not open a public issue for vulnerabilities.

Classes of issue we treat as security-sensitive:

• caveat sync accepting an anonymously readable destination or crossing the configured private ownership boundary.
• caveat publish including a private entry, bypassing its visibility/filter/scan gate, or exposing plaintext instead of the sealed bundle.
• A sealed bundle, key lookup, or subscriber path that leaks plaintext or cryptographic key material outside the intended process boundary.
• caveat_update permitting mutation of an immutable frontmatter key (id, created_at, source_session, source_project).
• caveat community add accepting a URL that bypasses the GitHub-only allowlist in validateCommunityUrl.
• The MCP server writing non-JSON-RPC content to stdout (breaks clients, potential injection vector).
• parseMarkdown accepting YAML tags outside JSON_SCHEMA (e.g. !!js/function).
• Any path where a user's ~/.claude/settings.json backup is skipped when the installer mutates the file.

Caveat does not validate or moderate content from arbitrary third parties. Trust is defined socially: subscribers choose which repository owners to trust. Private sharing uses caveat sync with a non-anonymously-readable remote. Public sharing uses caveat publish, which filters to public entries and emits a sealed AES-256-GCM bundle. Sealing protects public-mirror contents at rest; it is not authentication and does not make an untrusted publisher trustworthy.

I aim to acknowledge reports within 72 hours and ship a patched release within two weeks when the report is reproducible. Coordinated disclosure is welcome.