Do NOT open a public GitHub issue for security vulnerabilities.

1. GitHub Security Advisory (preferred): Create a private advisory
2. Email: dev@brain-tree.ai

• Description of the vulnerability
• Steps to reproduce
• Potential impact
• Suggested fix (if you have one)

• 48 hours: We will acknowledge receipt of your report
• 7 days: We will triage and provide an initial assessment
• 30 days: We aim to release a fix for confirmed vulnerabilities

BrainTree OS runs entirely locally on your machine. The primary security concerns are:

• Local file access (the server reads/writes files on your filesystem)
• WebSocket connections (localhost only)
• CLI command execution

In scope:

• Path traversal vulnerabilities (reading files outside brain directories)
• WebSocket injection or hijacking
• Arbitrary code execution through crafted brain files
• Dependencies with known CVEs

Out of scope:

• Issues requiring physical access to the host machine
• Social engineering attacks
• Vulnerabilities in outdated versions (please update first)

We appreciate responsible disclosure. With your permission, we will credit you in the release notes.