DeployProof is dedicated to local-first security and developer safety. If you discover a security vulnerability, sandbox-escape defect, or potential credential exposure vector within DeployProof:

1. Do NOT open a public GitHub issue.
2. Please report findings privately via GitHub Private Vulnerability Reporting on the repository page: https://github.com/SVSPraveen/deployproof/security/advisories/new.
3. Include a detailed description of the vulnerability, reproduction steps or sample repository fixture, and potential impact.

• Acknowledgment: You will receive an initial response confirming receipt of your report within 48 hours.
• Assessment & Fix: A triage assessment and patch timeline will be shared following verification.
• Coordinated Disclosure: A public advisory and CVE (if applicable) will be published alongside the patched release on PyPI.

• Local-First Processing: DeployProof runs strictly on the local machine with zero external telemetry. No source code, credentials, test results, or repository paths are ever sent to external servers.
• Network Boundaries: Outbound network requests are strictly limited to read-only queries against:
  1. The official PyPI JSON API (https://pypi.org/pypi/<pkg>/json) to verify package existence and registration age.
  2. The open OSV Database (https://api.osv.dev/v1/query) when CVE verification is active (can be disabled via --no-check-cve or offline execution).
• Sandbox Isolation: Temporary process sandboxes created during parallel mutation testing (--workers) are automatically cleaned up on process termination via signal handlers.