If you discover a security vulnerability in oracle-core, please report it responsibly.
Do NOT open a public issue.
Email: wyrd@wyrdsekai.org
We will acknowledge receipt within 3 business days and give you an initial assessment within 14 days. If a fix is warranted we aim to release it and publish an advisory within 90 days of the report — the usual disclosure window — and sooner when an issue is being actively exploited. If we need longer, we will tell you why rather than let the deadline pass in silence.
Unless you ask us not to, we will name you in the advisory and the release notes for the fix. Tell us how you would like to be credited (name, handle, affiliation, a link); if you say nothing we will use the name you reported under. We do not run a bug bounty and cannot offer payment — credit and a straight answer are what we have.
We will not pursue or support legal action against anyone who reports in good faith, stays within the scope below, avoids privacy violations and service disruption, and gives us reasonable time to respond before disclosing.
oracle-core processes personal data locally. Security concerns include:
- Data leakage from the store (JSONL files on disk)
- Pickle deserialization attacks (model files)
- Server endpoint abuse (Flask API)
- Information disclosure via predictions
- All data stays local. No telemetry, no cloud, no phone-home.
- Per-user isolation in the store.
- The Flask server binds to localhost by default.
- Pickle files are only loaded from the user's own data directory.