If you discover a security vulnerability in Code Engine, please report it responsibly.

Do NOT open a public GitHub issue for security vulnerabilities.

Instead, please send an email to the project maintainers with:

1. A description of the vulnerability
2. Steps to reproduce the issue
3. Potential impact assessment
4. Suggested fix (if available)

• Acknowledgment within 48 hours
• Status update within 7 days
• Resolution timeline communicated within 14 days

Code Engine processes untrusted source code files. Key security design decisions:

• No code execution: The engine only parses source code into ASTs — it never executes indexed code
• SQLite parameterized queries: All database queries use prepared statements to prevent SQL injection
• File system sandboxing: The engine only reads files within the specified project directory
• No network access: Core indexing and parsing operations make no outbound network requests
• Input validation: File paths and user inputs are validated before processing

When deploying Code Engine:

• Run with minimal system privileges
• Index only trusted repositories
• Keep dependencies up to date
• Review the IGNORED_DIRECTORIES and IGNORED_EXTENSIONS lists in src/constants.js for your use case