Security & Disclosure
aDNA is an open standard and a set of plain-Markdown, local-first knowledge vaults. The project ships no runtime service by default. Even so, we take coordinated disclosure seriously — here is how to report a vulnerability and what to expect.
Reporting a vulnerability
Please report privately — do not open a public issue for a security problem. Open a private report through GitHub Security Advisories on the canonical repository:
Report a vulnerability privately →
If you cannot use GitHub Security Advisories, open a public issue that says only “security report — please open a private channel”. Include no details there. A maintainer will follow up privately. When you can, tell us the affected file, route or script, the steps to reproduce it, and the impact you expect.
Scope
In scope: the published standard and its templates — the
.adna/ tree, the skills, the governance templates. The website tooling and
build scripts in the repository (site/, scripts/). And anything
the repository runs itself: CI, and the gate harness.
Out of scope: third-party tools that aDNA works alongside — Obsidian, Claude Code, git hosts. Report those to their own maintainers. Also out of scope: deployments and private vaults you run on your own machines.
What to expect
- Acknowledgement — we aim to acknowledge a report within a few business days.
- Assessment — we confirm the issue, determine severity and affected versions, and keep you updated.
- Coordinated disclosure — we agree a disclosure timeline with you and credit you in the advisory unless you prefer to remain anonymous.
Securing your own vault
aDNA vaults are local-first by design and are not pushed to a remote unless you configure one. Treat your vault's inventory, credentials index, and node identity as sensitive, and never commit real secrets — the standard's credential-handling doctrine keeps secret names, never secret values, in the vault.
The machine-readable policy is also at
SECURITY.md
in the repository.