μ-code is a local developer tool, but we take security seriously. If you find a security vulnerability:

Do not open a public issue. Please report it privately instead:

• Open a private security advisory
• Or email the maintainers via the contact address on the GitHub profile

Please include:

• A description of the vulnerability and its impact
• Steps to reproduce
• Affected versions
• Any suggested fix, if you have one

You can expect an acknowledgement within 5 business days, and we'll keep you updated as we work on a fix. We ask that you refrain from public disclosure until the issue is resolved.

• The mu CLI and its execution of user-approved bash_exec, edit_file, and write_file operations
• The ~/.mu-code/config.json handling, especially API keys passed via ai_base_url

• μ-code runs shell commands and modifies files only after explicit user approval, unless auto_approve: true is set.
• If auto_approve: true is enabled, the model has unrestricted file and shell access. Use only in sandboxed or trusted environments.
• If your ai_base_url contains an API key, restrict the config file with chmod 600 ~/.mu-code/config.json.