ContextAdapt processes Agent trajectories, which may contain source code, credentials, personal data, or internal operational details.

Please use GitHub's Report a vulnerability button on this repository's Security page. Private vulnerability reporting keeps the report and follow-up discussion visible only to the reporter and repository maintainers.

Do not open a public issue containing an exploit, secret, private trace, or personal information. Provide the smallest synthetic reproducer possible and remove unrelated content before submitting the private report.

• ContextAdapt's core diagnostic command runs locally and does not send trace contents to a model or external service.
• Contributors must not commit raw credentials, private repositories, personal conversations, or proprietary traces.
• Adapters should redact sensitive fields before serializing contextadapt.trace.v1.
• Automatic tier recommendation trusts only host-produced context:profile metadata and full-event context_span measurements. Keep those records out of planner control. ContextAdapt validates their shape and source label but cannot cryptographically authenticate a JSONL file supplied by an attacker.
• A context profile must explicitly use the supported suffix-window policy and allowlist observation-producing tool sources. Planner, user, policy, and host events cannot be allowlisted as successful tool observations.
• The Codex adapter redacts raw identifiers, prompts, messages, commands, outputs, errors, and tool payloads by default. Its SHA-256 fingerprints can still reveal short or guessable values through offline guessing; they are for correlation, not anonymization.
• --include-content creates a sensitive local artifact. Do not attach that output to a public issue without line-by-line review.
• analyze-codex --allow-remote-content sends the selected events' raw text and facts to the configured Codex model. Codex also adds provider system and runtime context. ContextAdapt uses an empty temporary workspace, ignores project rules, and requests a read-only sandbox, but users must still review the selected events before consenting.
• analyze-codex --output-dir stores proposal and review artifacts containing verbatim evidence quotes. Treat that directory as sensitive trace data.
• run-codex --allow-remote-content sends the new task to two independent Luna recorder calls and then sends the selected history to the task Agent. Its local session and .contextadapt/runtime files may contain raw prompts, target-file contents, and tool-status fingerprints. Do not commit or publish those files without review.
• The OMP extension performs a read-only preflight of an in-workspace target up to 1 MB and may inject that content into model-visible context. Paths outside the workspace fail closed. Sensitive paths are classified by host rules, not by the task Agent; projects with additional protected resources should add host-level policy before relying on the first default rule set.
• Executor hooks receive the Agent's actual tool arguments. Keep guard files and hook commands under host control, use absolute paths where practical, and do not log raw patches or commands unless the destination is approved for the same sensitivity as the source repository.
• A ContextAdapt hook supplements the Agent sandbox and operating-system access controls; it does not replace them. Unsupported or opaque tool paths must be disabled, separately guarded, or treated as outside the v0.2 guarantee.
• Risk output is diagnostic evidence, not an authorization decision. Protected actions should also be guarded by the host Agent environment.