The latest GitHub Release receives security fixes. CloudSeatbelt is a local CLI with no network, account, service, or telemetry component.
Use the repository's Security tab to submit a private vulnerability report. Do not open a public issue for a vulnerability that could expose user paths, corrupt reports, follow links, read file contents, or change filesystem state.
Include the CloudSeatbelt version, Windows version, filesystem/provider, reproduction steps, expected behavior, and observed behavior. Do not attach personal files or cloud credentials.
- CLI paths and snapshot JSON are external input and fail on parse, traversal, or write errors.
- Scan does not execute input, follow links, open file bodies, contact a network, or mutate attributes.
- Markdown is an evidence artifact; consumers should still treat paths inside it as untrusted text.
Cargo.lockis authoritative for release builds, and CI audits it for known advisories.
The protected assets are file bodies, source-tree state, and the integrity of scan evidence. The main abuse cases are accidental placeholder hydration, traversal through a link, presenting a partial walk as success, and rendering a hostile path as Markdown/HTML. Controls are metadata-only Win32 calls, non-following traversal, fail-fast reporting, and HTML escaping in Markdown paths. There is no authentication, remote API, secret store, or server attack surface in v0.1.0.