Report suspected vulnerabilities privately so maintainers can investigate before exploit details become public. Don't open a public issue, pull request, or discussion for a vulnerability.

Security fixes target these versions:

Use GitHub private vulnerability reporting. If the private reporting form isn't available, wait for the repository owner to enable it rather than publishing exploit details.

Include the information that helps reproduce and assess the problem:

• Affected Compass version or commit
• Operating system and installation method
• Vulnerable command, input, or integration
• Reproduction steps or a minimal proof of concept
• Expected and observed behavior
• Potential impact and affected data
• Suggested mitigation, if you have one

Remove API keys, database passwords, private source code, and unrelated personal data from the report.

Give maintainers time to reproduce, assess, fix, and publish an advisory before sharing details elsewhere. The project doesn't promise a fixed response or release time because severity and remediation scope vary.

Maintainers will use the private advisory to coordinate questions, credit, affected versions, mitigations, and publication. A report may be closed when it doesn't cross a security boundary or can't be reproduced from the supplied information.

Compass parses untrusted project content and graph files. Its default structural build and query workflow stays local, but these opt-in features cross process or network boundaries:

• Semantic extraction sends selected content to the configured model provider
• Streamable HTTP exposes the Model Context Protocol server on the configured interface
• Agent Graph mutation is a separate opt-in capability. HTTP deployments must use distinct non-empty read and write API keys, canonical project allowlists, and server-owned principals/permissions. The write tool is absent when disabled; mask capability must be enabled separately. Never place prompts, responses, chain-of-thought, credentials, or source excerpts in audit metadata.
• Neo4j and FalkorDB pushes connect to external databases
• URL acquisition and Google Workspace extraction access configured external services
• PostgreSQL extraction connects to the supplied database server
• Assistant setup can register local command hooks. Review generated hook files before trusting them in the host, and reinstall after moving the Compass executable so the managed command path remains accurate.
• compass upgrade downloads the bounded compass.release/1 manifest and the selected archive from official GitHub release URLs. It validates the schema, stable tag/version binding, bounded unique targets, selected archive name and size, SHA-256 digest, archive path, and staged executable version before replacing the running binary.
• compass review parses exact untrusted Git objects without checking out or executing their code. Its reusable Action must run in a dedicated job that has not executed contributor-controlled scripts; the write token belongs only in the pinned comment-delivery step. Fork reviews publish read-only evidence and suppress comments. Never use pull_request_target to execute a contributor head.

Include the selected options and endpoint type in reports about these features. Never include live credentials.

graph.json, store.ref, backup manifests, SQLite files, and future adapter objects are untrusted input. Compass validates schema majors, bounded sizes, content digests, active selectors, canonical JSON export, and reference bindings before exposing a store snapshot. compass store restore is fail-closed, restores only into a new destination, and removes an incomplete destination on validation failure. Stop writers before copying a redb file; the SQLite backup command checkpoints WAL for this purpose.

The namespace is an isolation and lifecycle key, not an authorization mechanism. A future hosted adapter must add authentication, authorization, TLS, audit logging, quotas, and tenant-scoped GC outside the common contract. The local release has no cloud endpoint, credential, or TLS setting and does not link cloud SDKs into the CLI. Never attach a store database or raw backup to a public issue: it can disclose repository names, paths, source anchors, and graph structure. Share a sanitized compass store status --format json response instead.

PDF and OOXML files, XML relationships, compressed members, embedded images, model files, OCR output, and document cache entries are untrusted. Compass enforces raw/archive/member/ratio/XML-depth/document/raster limits. Raw file and cache reads remain stream-bounded if a file grows after its metadata is read. Compass rejects package traversal, duplicate normalized members, incoherent OCR origin/profile/geometry, and unknown cache fields; it never executes spreadsheet formulas or embedded objects and never follows external document links.

compass models install is the only OCR download boundary. It accepts only the pinned profile catalog, fixed HTTPS host, declared byte size, SHA-256, and at most three validated redirects to the fixed artifact host. Concurrent installation of one profile is serialized with a bounded lock. Publication uses temporary files, directory synchronization, and an atomic verified marker; model artifacts, markers, and install locks must be regular non-symlink files. Inspection, extraction, listing, verification, cache replay, and historical materialization never silently fetch or invoke an arbitrary executable. Model and document cache paths can contain sensitive derived content and should not be attached to public issues.