Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.

Report them privately through GitHub's security advisory form. This lets us investigate and ship a fix before the issue is public.

Please include:

• a description of the vulnerability and its impact,
• the corpus version and how it was built or installed,
• steps to reproduce, ideally a minimal proof of concept.

We aim to acknowledge a report within a few days and will keep you updated as we work on a fix. We follow coordinated disclosure: once a fix is available we'll publish an advisory and credit you, unless you'd prefer to remain anonymous.

Security fixes land on the latest published release line and ship in a new patch release. We don't backport to older minor or major versions — upgrade to the latest release to stay covered.

corpus is a component of the Barnett Studios agentic-harness toolkit. It runs locally as part of a developer/CI workflow. Reports about the component mishandling untrusted input (a crafted repository, manifest, diff, or config it is pointed at) are in scope.