Zelari Code is maintained by Anathema Studio.

Security fixes are applied on the latest published release line on npm (zelari-code / @zelari/core). Please upgrade before reporting issues that may already be fixed in a newer version.

Please do not open a public GitHub issue for security-sensitive reports (especially if they include API keys, tokens, or paths to private data).

Prefer:

1. GitHub Security Advisories on N-THEM-Studio/zelari-code (private disclosure), or
2. Contact via anathema-studio.com if advisories are unavailable.

Include:

• Affected version(s) and install method (npm, Desktop, monorepo)
• OS and Node version
• Clear reproduction steps
• Impact assessment (RCE, path escape, secret leak, etc.)

We aim to acknowledge reports within a reasonable time and will coordinate a fix release when appropriate.

• Sandbox path escapes outside the project root for filesystem tools
• Shell blocklist bypasses that enable clearly dangerous commands by default
• Hardcoded secrets or credential leakage in shipped packages
• Unsafe deserialization or path traversal in CLI config loaders
• Desktop updater / installer issues that enable code execution without user consent

• Model / prompt injection that relies on the LLM choosing to call tools with attacker-controlled content (inherent agent risk; mitigate with phase plan, sandbox, and human review)
• Vulnerabilities only present in optional user-installed MCP servers or language servers
• Issues in third-party provider APIs (OpenAI-compatible endpoints, etc.)
• Denial of service via intentional huge model contexts or unbounded user tasks without a clear bug in resource limits

See docs/THREAT_MODEL.md — the full vector × gate × status matrix (guaranteed / mitigated / open) covering prompt injection (file/web/MCP output), exfiltration via ssh_run, untrusted-repo hooks, plugins, and what a fresh clone loads by default.

• API keys live under ~/.zelari-code/ (and related env overrides) — never commit them
• SSH secrets: ~/.zelari-code/ssh-secrets.json (never paste into chat)
• Kill switches: ZELARI_SSH=0, ZELARI_MCP=0, ZELARI_BROWSER=0, ZELARI_FOLDER_TRUST=0, etc.
• Plan phase (/plan or --phase plan) blocks project-mutating tools
• Folder trust (/trust, ~/.zelari-code/trust.json): project-scoped MCP and lifecycle hooks load only for trusted folders. User-global MCP/hooks stay active. Untrusted .zelari/mcp.json is ignored.
• Lifecycle hooks: fail-open in the TUI (only an explicit JSON deny blocks a tool), fail-closed in autonomous runs (headless/mission/CI: a hook crash/timeout denies). ZELARI_HOOKS_FAILURE=fail-open|fail-closed overrides.
• Companion zelari-code serve binds a LAN/Tailscale token (~/.zelari-code/companion.token) — do not expose 0.0.0.0 on the public internet.

Coordinated disclosure: please allow time for a fix before public write-ups. We appreciate responsible researchers and will credit them if desired.