Security

Reporting

Please report security issues privately using the GitHub Security Advisories feature:

• Go to our Security Advisories page.
• Explain the vulnerability, the potential impact, and steps to reproduce.
• Include relevant context such as version, OS, shell, runtime, and install method.

By using GitHub's private vulnerability reporting, you help ensure the issue is resolved before it is disclosed publicly. Once a fix is available, we can credit you in the release notes unless you prefer to stay anonymous.

Supported versions

Until 1.0.0, only the latest published alpha is expected to receive security fixes.

What is in scope

• The CLI in packages/cli, especially tool execution, onboarding, credentials, model calls, terminal rendering, and agent permissions.
• Shared tool schemas and model metadata in packages/shared.
• Website code that could expose users or misrepresent downloads.
• npm package publishing or release integrity for KnightCode.

What is not

• Issues in upstream dependencies unless KnightCode needs a specific mitigation.
• Provider-side behavior from OpenRouter, search APIs, or other services you configure.
• Anything requiring an already-compromised local machine or a user intentionally approving a destructive command.

How KnightCode reduces risk

• Explicit tool flow. File edits, shell commands, web fetches, and subagent work are visible in the terminal session.
• Approval and allow rules. Repeated command patterns can be controlled instead of silently executed.
• Local project state. Task files and rules live near the repository, making them inspectable.
• BYOK model access. KnightCode does not run a hosted model proxy for your code.

What we cannot promise

• KnightCode can run powerful local actions when you approve them. Use source control and review the work.
• Providers see whatever context you send them. Review their retention and training policies.
• Alpha releases may change quickly. Keep the CLI updated and report suspicious behavior.