Security

docs/SECURITY.md

Security Policy

This project is defensive and offline-first.

Scope

Audits code you own or have permission to test.
Focuses on static analysis and secure remediation guidance.

Out of scope

Exploit payloads, weaponized instructions, or guidance to compromise systems.
Scanning third-party services without authorization.

Reporting issues

If you find a bug in Citadel Local, open a GitHub issue with:

steps to reproduce
environment details
logs (redact secrets)

There aren’t any published security advisories