If you discover a security vulnerability in Cairn, please report it responsibly.

Do NOT open a public issue.

Instead, use one of these methods:

1. GitHub Security Advisories (preferred): Go to the Security Advisories page and create a private advisory.
2. Email: Contact the maintainers at kaleb@tracqi.com.

• Description of the vulnerability
• Steps to reproduce
• Affected versions
• Potential impact

• Acknowledgment: Within 48 hours
• Initial assessment: Within 1 week
• Fix or mitigation: Depends on severity, targeting within 2 weeks for critical issues

This policy covers the cairn Python package only. Issues with Claude Code itself should be reported to Anthropic.

• All SQL queries use parameterized statements (no string interpolation)
• File paths are validated against traversal attacks on export/import
• The optional encryption layer uses cryptography with secrets.token_bytes() for key generation
• The encryption key is stored at ~/.cairn/.key with restricted permissions
• The UDS hook socket is created with mode 0o600