If you believe you've found a security vulnerability in bloomctl, please report it privately via GitHub Security Advisories.

We aim to acknowledge reports within 72 hours and to coordinate disclosure once a fix is available.

bloomctl is a local CLI that talks to the iru Endpoint Management API. Vulnerabilities in iru's service itself should be reported to iru/Kandji directly, not here.

In-scope examples:

• Credential mishandling (token leakage to logs, audit trail, error output)
• Audit-trail redaction failures (sensitive fields not stripped)
• Supply-chain issues in bloomctl's dependency graph

bloomctl's entire subject matter is a live device fleet. Payloads and even metadata identify it. Treat ALL of the following as confidential tenant data — never paste it into issues, PRs, commits, discussions, or public logs:

• Device payloads — serials, UDIDs, device names, asset tags, user names/emails, OS inventory, installed apps/profiles.
• Secrets-endpoint output — FileVault recovery keys, activation lock bypass codes, recovery-lock passwords, unlock PINs. These are GET endpoints, so the write-guard does NOT gate them: read-only is not the same as non-sensitive.
• Vulnerability and threat data — CVE exposure per device is a targeting map of the fleet.
• Audit-trail lines — they carry real path/query parameter values (device ids, filters), the tenant hostname inside pagination URLs, your local hostname/username, and CEL predicate text.
• The tenant subdomain itself, and any *.api.kandji.io / *.connect.iru.com hostname containing it.

Defenses in this repo:

• scripts/check-tenant-leaks.sh runs in pre-commit (lefthook) and CI with publishable generic patterns; add your tenant's literals to a gitignored .leak-patterns.local for local enforcement.
• GitHub secret scanning + push protection are enabled on the repo.
• Fixtures under examples/fixtures/ are synthetic by policy — never regenerated by copying live payloads (see examples/README.md).
• BLOOMCTL_AUDIT=off disables the trail for a session; BLOOMCTL_AUDIT_DIR relocates it. The trail lives outside any repo by default (~/.bloomctl/audit/ on macOS, ~/.local/state/bloomctl/audit/ on Linux).

When reporting a bloomctl bug, follow the sanitization checklist in CONTRIBUTING.md and the issue template.

bloomctl writes a local JSONL audit trail of every API call. By design this trail strips authentication tokens and known sensitive payload fields before writing. See docs/audit-trail-format.md for the redaction policy. Report any field that leaks via the channel above.