SKE 0.1 is a pre-1.0 local developer tool with native package definitions for Windows, macOS, and Linux on x64 and ARM64. A distributed artifact is supported only when its matching native release job and manual VS Code pass are green; renamed or cross-OS binaries are not supported. Security fixes are applied to the current development line; no older release line is currently maintained.

Use a private security advisory on the canonical source repository when that facility is available. If it is not available, contact the maintainers through an existing private channel before opening a public issue. Include:

• affected version, platform, and install method;
• a minimal reproduction using non-sensitive source;
• expected and observed trust-boundary behavior;
• impact, required privileges, and whether a repository must be malicious;
• relevant logs with paths, source excerpts, tokens, and personal data removed.

Do not attach a real SKE cache, proprietary repository, access token, private key, or unredacted evidence export. Please allow maintainers to reproduce and prepare a fix before public disclosure.

SKE is local-first and has no supported runtime network, account, cloud, telemetry, plugin, AI-model, or hosted-database dependency. Its principal trust boundaries are:

• Repository input: TypeScript/config files are untrusted data. SKE does not run package scripts, repository binaries, plugins, or the repository's local TypeScript installation.
• Semantic worker: the engine starts a pinned, bundled compiler bridge with a cleared environment and bounded JSON-RPC stdio. Paths are canonicalized and constrained to the indexed root. Requests and fact pages have size limits.
• Cache: SQLite/WAL contains source-derived names and bounded excerpts. It is local sensitive data and should be protected like the source repository. ske doctor performs exhaustive integrity checks. Confirmed repair quarantines corrupt DB/WAL/SHM before rebuilding and never edits source.
• VS Code host/webview: the extension does not support untrusted workspaces. The webview has a network-denying CSP, loads packaged assets only, receives bounded focused subgraphs, and requests source navigation through the host.
• Source navigation: evidence ranges are selected only after the current file content hash is validated against the indexed snapshot.
• Structured exports: exports may contain paths, symbol names, source ranges, and excerpts. They are bounded but not automatically anonymized.

The CLI bundle depends on a locally installed Node.js 22.12-or-newer runtime for the bundled worker. Keep the OS, Node.js, VS Code, and SKE release patched. Do not substitute an untrusted SKE_NODE_PATH, SKE_WORKER_PATH, or engine binary.

• Use a cache directory accessible only to the intended local user.
• Do not commit evidence.sqlite3, WAL/SHM files, writer locks, logs, quarantine directories, or evidence JSON to source control.
• Remove both the active cache and its quarantine directory when repository retention requirements call for deletion.
• Review an evidence export before sharing it outside the repository's trust boundary.
• Verify release CHECKSUMS.sha256 before installation.

Examples include path escape, source modification, arbitrary repository code execution, command/argument injection, cache integrity bypass, stale evidence opened as current, webview CSP escape, unbounded IPC/query memory exhaustion, worker survival after cancellation/shutdown, unexpected network access, and leakage of source-derived data outside documented local files/exports.

Performance bugs, unsupported web/virtual-workspace behavior, incorrect compiler facts without a security boundary impact, and requests to add cloud/AI features are normally handled as non-security defects.