We actively maintain security updates for the following versions:

We take security vulnerabilities seriously. If you discover a security issue, please follow these steps:

Never report security vulnerabilities through public GitHub issues, discussions, or other public channels.

Send a detailed report to our security team at:

• Email: security@consiliency.com
• Subject: [SECURITY] Tree-sitter Chunker Vulnerability Report

• Description: Clear description of the vulnerability
• Impact: Potential impact on users and systems
• Steps to Reproduce: Detailed steps to reproduce the issue
• Proof of Concept: Code or examples if applicable
• Affected Versions: Which versions are affected
• Suggested Fix: If you have ideas for fixing the issue

• Initial Response: Within 24 hours
• Assessment: Within 3 business days
• Fix Development: Depends on complexity
• Public Disclosure: After fix is available

• File Paths: Strict validation of file paths to prevent path traversal attacks
• API Filesystem Access: Filesystem-backed REST endpoints require Bearer authentication and canonically confine relative paths to the configured API root, including rejection of symlink escapes
• API Exposure: The directly-run server binds loopback by default, limits request bodies to 1 MiB, and does not allow credentialed wildcard CORS
• PostgreSQL Exports: Direct connections require an exact host allowlist; generated SQL escapes every interpolated string literal
• Language Detection: Safe language detection without code execution
• Configuration Files: Secure parsing of configuration files
• Grammar Sources: Exact-host HTTPS validation, immutable-version checksum manifests, and verification before grammar archives are extracted or compiled
• Plugin Directories: Custom plugin directories require explicit opt-in before their Python modules are executed

• Parser Isolation: Tree-sitter parsers run in isolated environments
• Memory Limits: Configurable memory limits for large files
• Execution Restrictions: No arbitrary code execution capabilities

• No Data Collection: We do not collect or transmit user data
• Local Processing: All processing happens locally on your machine
• Secure Caching: Local cache with proper file permissions

• Dependency Scanning: Regular scanning for vulnerable dependencies
• Code Analysis: Static analysis for security issues
• Fuzzing: Automated fuzzing of parser inputs
• Penetration Testing: Regular security assessments

• Code Reviews: Security-focused code reviews
• Architecture Reviews: Security architecture assessments
• Third-Party Audits: External security audits

• Severity classification (Critical, High, Medium, Low)
• Impact analysis
• Affected version identification

• Security patch development
• Testing and validation
• Backward compatibility assessment

• Security patch release
• Public disclosure (after fix availability)
• CVE assignment if applicable

• Security advisory publication
• User notification through multiple channels
• Documentation updates

• File System Access: Requires read access to source files
• Network Access: May download grammar files from GitHub
• Memory Usage: Large files may consume significant memory

• File Permissions: Use appropriate file permissions
• Network Security: Configure firewall rules for grammar downloads
• Resource Limits: Set appropriate memory and CPU limits

# Use official sources only
pip install treesitter-chunker

# Verify package integrity
pip install --require-hashes treesitter-chunker

# Use virtual environments
python -m venv venv
source venv/bin/activate
pip install treesitter-chunker

# Limit file access to trusted directories
import os
os.chdir('/trusted/source/directory')

# Use appropriate file permissions
# chmod 644 source_files/*.py

# Monitor resource usage
import resource
resource.setrlimit(resource.RLIMIT_AS, (1024*1024*1024, -1))  # 1GB memory limit

# .chunkerrc
# Restrict grammar sources to trusted repositories
grammar_sources = [
    "https://github.com/tree-sitter/tree-sitter-python",
    "https://github.com/tree-sitter/tree-sitter-javascript"
]

# Set appropriate limits
max_file_size = 100000000  # 100MB
max_memory_usage = 1073741824  # 1GB

We thank security researchers and users who responsibly report vulnerabilities:

• Responsible Disclosure: Following responsible disclosure practices
• Security Research: Supporting security research and testing
• Community Collaboration: Working with the security community

• Email: security@consiliency.com
• Response Time: Within 24 hours
• PGP Key: Available upon request

• GitHub Security: Use GitHub's security advisory system
• Maintainers: Direct contact for urgent issues

For critical security issues requiring immediate attention:

• Email: security-emergency@consiliency.com
• Response Time: Within 4 hours

• Security Documentation: Security Guide
• Best Practices: Security Best Practices
• Vulnerability Database: CVE Database

• OWASP Security Guidelines
• Python Security Best Practices
• Tree-sitter Security

Security is everyone's responsibility. Thank you for helping keep Tree-sitter Chunker secure! 🛡️