Do not open a public issue containing a credential, session identifier, browser state, private path, private source code, or personal/customer data.
Use GitHub's Report a vulnerability flow in this repository's Security tab. If that flow is unavailable, open a minimal issue asking the maintainer to enable a private contact channel; do not include sensitive details.
Include:
- the affected version or commit
- the security boundary that failed
- minimal reproduction steps using fake credentials and disposable files
- the expected safe behavior
Security fixes target the latest release and the default branch.
This project never needs a credential committed to a repository. SOFA API keys, key metadata, skill digests, sessions, cookies, browser profiles, lease databases, and automation memory belong in machine-local secret or state storage.
The lease helper stores local coordination metadata, not authentication data. Its SQLite database must use an absolute path on a trusted local disk. Do not place it on a network share, synchronized folder, or world-writable directory.