ReproCert v1.0.0 is the current public stable release, supported within the documented Python 3.11–3.14 / tested Ubuntu, Windows and macOS CLI + GitHub Action product boundary. Security fixes are developed and qualified against the protected main branch and published only through separately verified release/channel updates. Immutable release tags are never silently patched; users should pin an exact qualified version for reproducible deployments. Historical v0.2.2a1 remains Alpha and is not the current stable release.
A ReproCert claim contains a command to execute. Treat a claim-file change as code-execution capability.
- Never expose secrets to untrusted claim changes.
- Use least-privilege GitHub Actions permissions.
- Do not use
pull_request_targetto execute untrusted contribution code. - ReproCert executes the declared command with
shell=False. - Evidence/source paths are constrained to the claim working directory.
- ReproCert does not intentionally capture environment-variable values.
Do not publish credentials, private customer data, or sensitive exploit details in a public issue.
If GitHub private vulnerability reporting is available for this repository, use it. Otherwise, open a non-sensitive issue requesting a private security contact channel without disclosing exploit details.
A ReproCert PASS result is not a security certification of the executed program, dependency set, runner, or evidence source. See docs/THREAT_MODEL.md.