Email founders@archsteer.io with the details (a proof-of-concept helps). Please don't open a public issue for anything exploitable — give us a chance to ship a fix first. You'll get an acknowledgement within 2 business days and a status update at least weekly until it's resolved. We'll credit you in the release notes unless you'd rather stay anonymous.

Only the latest published version of archsteer on PyPI receives security fixes. Staying current is a one-line change (pip install -U archsteer, or automatic if you launch it via pipx run archsteer).

• Local-first by design. The CLI reads your repository's source and git history on disk to derive .archsteer/model.json and runs conformance checks — no network calls, no telemetry, no code or file contents leave your machine.
• The optional [mcp] extra (archsteer mcp) runs a local MCP stdio server exposing get_target_pattern, check_file, and current_architecture to your AI coding agent — same local-only data model, no network egress.
• The separate web "situation room" (archsteer.com, Team tier) is an opt-in hosted control plane; the OSS CLI works fully standalone without it.

• Published from this public repository — what's on PyPI is built from the source you can read here.
• No native extensions, no build-time network fetches beyond normal PyPI dependency resolution.