DataSentry is a security tool; reports about its own weaknesses are taken seriously and handled privately.

Do not open a public issue for security problems. Report privately via GitHub's vulnerability reporting:

https://github.com/CaptainASIC/datasentry/security/advisories/new

Include: the rule or code path affected, a reproduction (with fake secrets only — values containing example or dummy are never redacted and are safe to paste), and the impact as you understand it.

You will receive an acknowledgment within 7 days. Confirmed vulnerabilities are fixed as the top priority and credited in the changelog unless you prefer otherwise.

In scope:

• Redaction bypasses: a secret matching a shipped rule that reaches the model context (hook payload paths, structured-response shapes, encoding tricks).
• Fail-open defects: any path where an engine error lets data through despite fail_mode: "closed".
• Audit log leaking secret values (it must only ever contain rule IDs and counts).

Out of scope:

• Secrets in formats no shipped rule claims to cover (that is the documented limitation in the README, not a vulnerability — but a proposed rule is welcome as a regular PR).
• The model's own output channel (no hook exists between model and transport; documented in "Honest limitations").
• Vulnerabilities in Claude Code itself — report those to Anthropic.

Only the latest release is supported. There are no security backports.