If you discover a security vulnerability in ProjectScylla, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

1. Email: Send details to research@villmow.us
2. Subject line: [SECURITY] ProjectScylla - Brief description
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgment: Within 48 hours
• Assessment: Within 1 week
• Resolution: Depends on severity; critical issues targeted within 2 weeks

The following are in scope for security reports:

• API key exposure or credential leakage
• Command injection in CLI or subprocess calls
• Unsafe deserialization of experiment data
• Docker container escape or privilege escalation
• Dependencies with known CVEs not covered by pip-audit

• Vulnerabilities in third-party services (Anthropic API, OpenAI API)
• Issues requiring physical access to the machine
• Social engineering attacks

When ProjectScylla runs evaluations it sends data to the Anthropic API:

• Prompts: system prompts, task descriptions, and any CLAUDE.md content included in the run
• Repository content: file snippets and code passed to the agent as context during test execution
• Agent outputs: intermediate tool calls, reasoning traces, and final responses (used as judge inputs)

No data is sent to third-party services other than the Anthropic API unless you explicitly configure additional MCP servers or tool integrations.

Users are responsible for ensuring that repository content included in prompts complies with their organisation's data-handling policies before running evaluations against the Anthropic API.

Refer to Anthropic's usage policies and privacy policy for details on how submitted data is handled.

For guidance on what experiment outputs are stored locally and how long to retain them, see docs/dev/data-policy.md.

ProjectScylla follows these security practices:

• No hardcoded secrets: API keys read from environment variables
• No shell=True: All subprocess calls use list-based arguments
• CVE scanning: pip-audit runs in CI and pre-commit hooks
• Credential isolation: Context-managed temporary credential mounts with restricted permissions
• Docker security: Non-root user, SHA256-pinned base images, health checks