Email support@saferico.com with SECURITY in the subject line.

Please include:

• what the issue is, and what an attacker gets out of it
• the version (npx saferico version prints the CLI and engine versions)
• the smallest input that reproduces it

Please do not open a public issue for a vulnerability. Open issues are read by everyone, including whoever would use the finding first.

You will get a reply within 72 hours. If you have not heard anything in a week, assume the mail did not arrive and send it again — silence here is a failure on our side, not a decision.

We do not currently run a paid bug-bounty programme. We will credit you by name in the release notes if you want to be credited, and will not name you if you prefer not to be.

This repository is the client: the command line, the local MCP server, and the harness that finds Solidity files and runs the analyser over them.

Findings we care about most, in order:

1. Anything that executes attacker-controlled code on a user's machine. This tool downloads an engine and runs it in a VM context — a way to make it run something else, or to defeat the SHA-256 verification in lib/engine.mjs, is the most serious class of bug this project can have.
2. Anything that sends a user's source code anywhere. The tool's central promise is that source never leaves the machine. A path that breaks it is a vulnerability even if nothing is "exploited".
3. Anything that makes the local MCP server reachable or drivable by something other than its own client — it speaks over stdio and binds no port; that must stay true.
4. Path traversal, command injection, or unsafe file writes from --output, --sarif or a config file.

• A detector missing a vulnerability, or reporting one that is not there. That is an accuracy issue, not a security issue. Report it the same way — we want to know — but it will not be treated as an embargoed disclosure.
• The hosted service (saferico.com, the API, the hosted MCP endpoint). Those are separate from this repository; report them to the same address, saying which surface you mean.
• Denial of service caused by pointing the scanner at a pathological input on your own machine.
• Anything requiring an attacker to already control the machine running the scan.

The newest published version is supported. Fixes ship as a new release rather than as a patch to an old one; there is no long-term support branch.

Stated so you can check it rather than trust it:

• Zero runtime dependencies. Nothing is installed alongside it, so there is no transitive package to compromise. npm view saferico dependencies is empty, and CI asserts it stays empty.
• The engine is verified before it runs. Both engine files are checked against the SHA-256 published in https://saferico.com/engine/manifest.json. A mismatch is a hard refusal, not a warning — see lib/engine.mjs.
• The engine runs in a vm context, not in the CLI's own global scope.
• Nothing is uploaded. There is no telemetry, no analytics and no upload flag. The only outbound request is for the engine files themselves.
• Publishing requires 2FA on the npm account.