Security and Support

Security and support

ALPHA — USE AT YOUR OWN RISK. .SYSTEMX is experimental and may change daily. Pin a reviewed release, keep recoverable backups, and validate it in your project. Template checks do not certify production readiness. See release policy.

Current alpha: 1.8.4-alpha.1 · Alpha1 branch

.SYSTEMX is alpha: use at your own risk, expect possible daily changes, and pin a reviewed release. Start with first-time setup, release policy, and uninstall and cleanup.

For bugs, questions, and feature requests, use GitHub Issues. Include systemx --version, the selected defaults version from systemx status --target PATH, OS/Python version, setup profile, expected behavior, and a minimal reproduction in a temporary project. An old copied root VERSION may differ from the active defaults; report both when relevant.

Review and redact logs before posting. Status and operation receipts can contain local paths; exported context can contain private project data. Share only the smallest sanitized evidence needed. Sensitive vulnerabilities use the private reporting path.

Support is community/maintainer best effort, without an SLA or guaranteed release date. This project does not operate a hosted service, manage your cloud accounts, or install an MCP server. A passing template check is not a production audit.

Private security reports

.SYSTEMX is experimental alpha software, provided under the MIT License without warranty. It is not a production-readiness or security certification.

Report suspected vulnerabilities privately through GitHub private vulnerability reporting. That repository feature is enabled. Include the affected release/tool version, platform, expected boundary, and minimal sanitized reproduction. Never include credentials, customer information, or private project records in a public issue.

Reports are reviewed as maintainer capacity permits. There is no guaranteed response time, supported-version window, or backport commitment during alpha. Report issues in older releases too and identify the affected versions; do not assume an older numeric version is security-supported. Corrections will identify their affected and fixed versions when known.

The template manager downloads explicitly selected defaults and can run configured project commands with the caller's permissions. Review publishers, sources, commands, and target paths. Distribution fingerprints check consistency with their manifest; they do not independently authenticate a publisher. Avoid administrator privileges, protect project data and operation logs, coordinate writers, and keep recoverable backups.

Project-specific security guidance remains in .SYSTEMX/docs/SECURITY.md. Adopting projects must define their own security contacts, deployment boundaries, and incident process.