CommentRake edits other people's source code. A defect that writes the wrong bytes, writes outside the project, or leaks the contents of a private repository is a security defect here, even when it would be an ordinary bug in a tool that only reads.

The project is pre-alpha and has no releases yet. The version is 0.1.0.dev0 and the package is installed from source. Fixes go to main; there is no branch receiving backports.

Report privately through GitHub, not in a public issue:

1. Open https://github.com/kroxiksut/comment-rake/security/advisories/new, or go to the repository's Security tab and choose Report a vulnerability.
2. Describe what an attacker or an accident can cause, and how to reproduce it. A minimal project tree, the command or the screen you used, and the version of Python and the operating system are enough to start.
3. Please do not include source code from a private repository. If a file is required to reproduce the problem, say so and we will agree on the smallest example that still shows it.

This is a single-maintainer project, so there is no response-time guarantee. Reports are read and answered; a fix lands on main and the advisory is published once it is available.

The write path is the sensitive part. In particular:

• writing to a file that no approved edit plan named, or writing without a successful dry run;
• resolving a relative path outside the canonical project root, including through a symbolic link or a path substituted between the scan and the write;
• an archive that does not restore what it recorded, or a restore that silently overwrites edits made after the cleanup session;
• source text, comment text, file paths, or environment values reaching the technical log, which is specified to contain none of them;
• turning a finding into an applied change without an explicit user decision;
• injecting an argument or a second command through the "Open in …" integration, which launches an external editor;
• any code path that opens a network connection. CommentRake has no network features.

The intended guarantees behind these are written out in the threat model for the modifying operations: English · Russian.

• Grammar defects belong upstream. Parsers come from tree-sitter-language-pack; report a mis-parsed language there. What belongs here is CommentRake trusting an uncertain parse.
• CommentRake does not sandbox the editor it launches on your request, and does not intend to.
• Damage caused by a deliberately hostile local configuration file. commentrake.toml is read with the trust level of the repository it sits in, the same as a build script.