CmdScope is a behavior analysis and policy enforcement tool. We hold ourselves to the highest standards of security and responsible engineering.

See THREAT_MODEL.md for the comprehensive analysis of what CmdScope protects against, what it does not, trust boundaries, and security assumptions.

• Trace evasion: Processes can detect ptrace and alter behavior.
• In-memory-only attacks: Only syscalls are visible.
• Encrypted network payloads: CmdScope sees connections, not content.
• Kernel-level compromises: strace output is unreliable if the kernel is compromised.
• Process isolation: CmdScope observes and gates; it does not sandbox. Use bubblewrap or containers for isolation.

• Zero network access. CmdScope makes no outbound connections. No telemetry, no update checks, no crash reports.
• No root required. CmdScope runs entirely in user space.
• Restrictive file permissions. All data stored with 0700 (dirs) and 0600 (files).
• No secrets stored. CmdScope records file paths, not file contents. Environment variable names are recorded; values are not.
• Deterministic redaction. The --redact flag sanitizes paths, IPs, usernames, and hostnames before serialization using str::replace on Rust structs, guaranteeing structurally valid output.

If you discover a security vulnerability in CmdScope, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Report via GitHub Security Advisory.

Include:

1. Clear description of the vulnerability.
2. Steps to reproduce.
3. Affected version.
4. Impact assessment.

We will acknowledge reports within 48 hours and work with you to resolve the issue before any public disclosure.

We recommend keeping your installation current:

cargo install cmdscope