Until ArchLens 1.0, security fixes are released on the newest minor version only.
| Version | Supported |
|---|---|
| 0.3.x | Yes |
| 0.2.x | No |
| Earlier | No |
Please do not open a public issue for a suspected vulnerability. Use GitHub's Security → Report a vulnerability flow for this repository. If private vulnerability reporting is unavailable, contact the repository owner through the private address listed on their GitHub profile.
Include a description, affected version, reproduction, impact, and any suggested mitigation. You can expect an acknowledgment within five business days and a status update within ten business days. Please allow maintainers a reasonable remediation window before public disclosure.
ArchLens reads untrusted repository trees and writes a report. It is designed to:
- never execute scanned source code;
- never evaluate project configuration;
- skip symbolic links during recursive walking;
- avoid network requests and telemetry;
- emit only repository-relative paths, metadata, and import specifiers;
- escape repository-derived values in HTML and neutralize C0/C1 terminal controls in Mermaid output;
- cap scanned file count by default.
Repository paths and import specifiers can still reveal sensitive architecture. Treat generated reports as source-adjacent artifacts and review them before sharing. Run ArchLens with the same filesystem privileges you would grant any local developer tool.
Reports based on already-compromised local files, denial of service requiring intentionally enormous input beyond configured safety limits, and vulnerabilities in unsupported Node.js releases are generally out of scope. Clear bypasses of scanning limits, report injection, unintended file reads, or code execution are in scope.