Skip to content

Repository navigation

Security: pannagkumaar/CodeFence

Security

SECURITY.md

Security policy

CodeFence is defensive tooling for Claude Code.

Safety model

  • It runs locally and sends no telemetry, source code, or secrets to external services.
  • It treats repository content as untrusted input.
  • If a scanner fails, the hook allows the session to continue rather than silently blocking it.
  • It does not modify source files, Git metadata, .gitignore, or Claude Code configuration. It writes only its own logs, reports, and session state.
  • Findings, command logs, and reports redact credentials.
  • Examples in this repository use fake secrets.

Out of scope

CodeFence does not exploit systems, contain malware or persistence, exfiltrate repository data, or rewrite user code automatically.

Report a vulnerability

For a flaw in CodeFence itself, open a private GitHub security advisory rather than a public issue. Include:

  • A minimal event JSON and hook mode that reproduce the problem.
  • The version from .claude-plugin/plugin.json.
  • Expected and actual behavior.

Security fixes land on the latest pre-1.0 release.

There aren't any published security advisories