| Version | Supported |
|---|---|
| 0.9.x | Yes |
| 0.8.x | Security fixes only |
| < 0.8 | No |
Please do not open a public GitHub issue for security vulnerabilities.
Instead, use GitHub's private Security Advisory feature to report directly.
Include in your report:
- Description of the vulnerability
- Steps to reproduce or proof of concept
- Affected versions
- Potential impact (especially any container escape or host exposure scenarios)
| Step | Target |
|---|---|
| Acknowledge receipt | 48 hours |
| Initial triage and severity assessment | 7 days |
| Fix development and private disclosure | 30 days |
| Public disclosure (release + advisory) | 90 days |
DevCell's security boundary is the container (or VM) wall. Vulnerabilities that allow any of the following are treated as critical:
- Container escape or host filesystem access outside the mounted project directory
- Credential leakage from the host into the cell
- Bypass of
--solitaryegress lockdown - Exposure of 1Password secrets beyond the RAM-only tmpfs
We credit researchers who responsibly report vulnerabilities in the release notes, with your permission.