Security fixes are provided for the latest published Sidelight version.

Please update to the newest release before reporting an issue that may already be addressed.

Please do not open a public issue containing exploit details, sensitive paths, repository contents, or proof-of-concept code.

GitHub private vulnerability reporting is enabled. Use the private vulnerability form. If that option is unavailable, contact the maintainer through the GitHub profile to request a private channel without including sensitive technical details in the initial message.

A useful report includes:

• the affected Sidelight version and platform;
• the smallest safe description of the affected boundary;
• whether a malicious repository, pathname, file type, Git configuration, or terminal content is required;
• expected versus observed behavior;
• reproduction material only after a private channel is established.

Please allow time for validation and a coordinated fix before public disclosure.

Sidelight is local-first and deliberately narrow:

• the TUI has no telemetry or application network features;
• project interaction is read-only;
• Git operations are constrained and bounded;
• previews, search results, status data, and terminal rendering apply deny-list and resource controls;
• optional session integrations write only allowlisted metadata to Sidelight's local state directory.

Sidelight is not an operating-system sandbox. It relies on the local Node.js runtime, Git executable, filesystem, terminal, and operating system. Platform-specific limitations and the product's durable boundaries are documented in PHILOSOPHY.md.

The v0.6.1 hardening work included an AI-assisted source-security assessment using the OpenAI Codex Security plugin, followed by maintainer triage, targeted remediation, rewritten local regression tests, and bounded independent revalidation.

This process is not a certification or penetration test, and no release should be interpreted as a claim that the software is free of vulnerabilities.