Paleae is designed with a simple security pledge: Your code is yours. It never leaves your machine.

• Local-First: The tool runs entirely on your machine.
• No Network Calls: It does not and will not make network requests.
• Zero Dependencies: It has no runtime dependencies, minimizing supply chain risk.
• Full Transparency: It is a single script you can read and verify.

You have full control and visibility over the data it produces.

The most critical security consideration when using Paleae is ensuring that the snapshots you generate do not contain sensitive information before you share them with an AI or any third party.

While Paleae itself is secure and local, the snapshot it creates is a new file containing your code. You are responsible for its contents.

Before sharing a snapshot:

1. Review the output JSON/JSONL file to ensure it doesn't contain API keys, passwords, or other secrets.
2. Use a .paleaeignore file to exclude sensitive files and directories. Common patterns to add include:

   # Common secrets and config
   .env
   *.pem
   *.key
   credentials.json
   settings.local.py
   

3. Ask your AI assistant for help. An AI can help you craft a robust .paleaeignore file tailored to your project's framework (e.g., Django, Rails, Node.js).

We accept security reports for:

• The latest release tag on GitHub
• The main branch (HEAD) as published in this repository

Older releases are generally unsupported unless the issue is severe and broadly impactful.

Preferred: Use GitHub’s Private Vulnerability Reporting (Security → “Report a vulnerability”) on this repo.
Fallback: Email paulctiffany@gmail.com with the details.

Note: While email is provided as a fallback, we strongly prefer using GitHub's Private Vulnerability Reporting for enhanced security and tracking. For future consideration, a dedicated security email alias (e.g., security@yourdomain.com) is recommended to manage reports and reduce spam.

Please include:

• Clear reproduction steps (commands, flags, input files if possible)
• Impact and likelihood
• A minimal proof-of-concept (no destructive payloads)
• Your preferred credit name/handle

We aim to acknowledge within 48 hours and provide a remediation plan or fix within 7–14 days for high-severity issues.

We follow coordinated disclosure:

1. We confirm and triage the report.
2. We prepare a fix and security advisory.
3. We publish a new release and advisory notes.
4. We credit reporters who request attribution.

If your report reveals active exploitation or widespread risk, we may accelerate timelines and/or release a temporary mitigation.

Because Paleae is a local CLI that reads files and writes snapshots:

• Path traversal or file read beyond the selected scope (e.g., bypassing includes/excludes/.paleaeignore)
• Determinism or hashing flaws that could silently corrupt or misrepresent snapshot contents
• Logic that causes unexpected network activity (none should exist)
• Unsanitized execution of external inputs (none should exist)
• Resource exhaustion that leads to unbounded memory/CPU usage despite caps

• General usability issues, performance tuning, or feature requests (please open a normal issue/PR)
• Impacts that require users to ignore documented flags, bypass .paleaeignore, or modify the code
• Scenarios that rely on malicious modification of the Paleae script after download (supply chain is handled by release integrity below)

Paleae intentionally does not upload or transmit data. Users are responsible for:

• Adding patterns to .paleaeignore (supports !negation to re-include)
• Verifying output before sharing snapshots publicly

If your report concerns accidental capture of secrets with default profiles, include a minimal example and we will consider safer defaults.

To reduce supply-chain risk:

• Always download from the official GitHub releases or repo.
• Verify the SHA-256 of paleae.py against the value posted in the release notes (when provided).
• Avoid third-party mirrors.

• Single file, Python standard library only (no runtime dependencies).
• No telemetry; no auto-update; no network calls.
• Deterministic traversal and hashing intended for reproducibility.

If you discover behavior that contradicts the above guarantees, please report it as a security issue.

We appreciate good-faith testing that avoids disrupting others. Please do not publicly disclose details before a fix is available. We are happy to discuss embargo timing if needed.

• Security contact: paulctiffany@gmail.com
• PGP key (optional): publish a fingerprint here if you require encrypted reports.