Foreword is pre-release. Treat the current repository as an open-source scaffold, not a hardened product.
| Version | Supported |
|---|---|
| v0.1 scaffold | Yes, best-effort |
Do not open a public issue with sensitive data.
Until a dedicated security contact exists, report privately to the repository owner. Include:
- what data could be exposed,
- which file or workflow is affected,
- how to reproduce the issue without sharing real career data,
- suggested mitigation if known.
- The open-source core should not collect telemetry.
- v0.1 should not require secrets or API keys.
- Connectors should be optional, read-only by default, and user-authorized for the current assistant environment.
- Tests should not require real user data.
- Example vaults must be fictional.
- Generated share artifacts should require explicit user intent.
- hosted sync,
- authentication,
- multi-user permissions,
- encrypted vault management,
- built-in connector OAuth flows or credential storage,
- browser or email automation.
These become relevant only after the local markdown workflow is proven.