TraceOtter processes local coding-agent trajectories. Treat those inputs as sensitive because they may include prompts, source code, repository paths, terminal output, secrets, and customer context.

Security fixes are accepted for the active main branch until the project publishes a separate release support policy. The package metadata currently requires Python 3.11 or newer.

Please report vulnerabilities by opening a GitHub security advisory or by contacting the maintainers through the repository's private security reporting channel when available.

Do not include secrets, raw local traces, private prompts, proprietary source code, customer data, or unreleased incident details in a public issue. If a proof of concept needs data, use a small synthetic fixture that shows the same parser, redaction, export, or quality-gate behavior without exposing private content.

Helpful reports include:

• the affected command or module;
• the expected and observed behavior;
• a sanitized reproduction fixture or command;
• the TraceOtter version or commit;
• whether any generated training artifact may have contained sensitive data.

TraceOtter's public quickstart and CI path must stay local-only: no telemetry, hosted-service dependency, secret-dependent setup, or automatic upload of traces or generated datasets.