Continuum is an early-stage 0.1.0 prototype. Some security-related features described in the roadmap — enforced exclusions, automatic secret detection/redaction, and encryption — are partially implemented or still in progress. Please don't treat the current default configuration as a complete set of active security controls; see the README's local data layout section for what's actually enforced today.

As a pre-1.0 prototype, only the latest commit on main is supported. There is no long-term-support branch yet.

Please do not open a public GitHub issue for security vulnerabilities.

Instead, report it privately using one of the following:

1. GitHub Private Vulnerability Reporting (preferred): open the "Security" tab on the repository and use "Report a vulnerability."
2. If that's unavailable, open a regular issue asking a maintainer to open a private channel — don't include exploit details in the issue itself.

When reporting, please include:

• A description of the vulnerability and its potential impact
• Steps to reproduce it (a minimal example is very helpful)
• Any relevant logs, ledger excerpts, or configuration (with secrets redacted)

This is a small, early-stage project maintained on a best-effort basis. We aim to:

• Acknowledge new reports within a reasonable timeframe
• Investigate and confirm the issue
• Work with you on a fix and coordinated disclosure timeline before any public write-up

Continuum is local-first by design — data stays on your machine unless you explicitly export or share a capsule. Given that, the areas of highest concern are:

• Secret/credential leakage into the ledger, bootstrap output, or shared capsules
• Integrity bypass (forged or tampered ledger events passing verification)
• Path traversal or unsafe file handling during import/export
• Encryption weaknesses in shared capsule handling

Issues in third-party dependencies should generally be reported upstream, but feel free to flag them here too if you're not sure.