Please do not open a public issue for security problems.

Send reports to:

iangel.oned@gmail.com

Include:

• Affected version or commit.
• Operating system.
• Steps to reproduce.
• Expected and actual impact.
• Any logs or screenshots that help confirm the issue.

The project aims to respond within 48 hours and coordinate a fix before public disclosure.

CodeClub is offline-first and BYOK. AI requests go directly from the user's device to the selected provider or local endpoint. The app should not add telemetry, proxy provider traffic, or cloud dependencies without an explicit product decision.

CodeClub is built from source in a fully verifiable pipeline:

• No obfuscation — The JavaScript shipped in releases is the same code in this repository, with no transformations that hide logic.
• No bytecode compilation — The main process runs as plain JavaScript, auditable by anyone.
• No adversarial injections — No code is injected to confuse analysis tools or bypass LLM review.
• No postinstall hooks — Dependencies are not modified after install.
• Reproducible builds — You can build from source using npm run build and compare the result against the release artifact.

If you suspect a discrepancy between the source and a published release, please report it immediately using the contact information above.

• expr-eval override (expr-eval → expr-eval-fork): @open-pencil/core depende de expr-eval. El override redirige a un fork mantenido por el mismo ecosistema para compatibilidad con Node.js moderno. Resuelto desde npm registry oficial, sin fuentes externas.