CX is currently pre-1.0. Security fixes target the latest release and the current main branch. Older revision tags may not receive backports.

Use GitHub private vulnerability reporting. If that surface is unavailable, contact the maintainer privately through the contact method listed on the contextlimit GitHub profile.

Do not post exploit details, real commands containing credentials, a real ~/.cx/db.sqlite, or raw failure artifacts in a public issue or community channel.

Include:

• CX version and build revision from cx --version;
• operating system and architecture;
• the smallest synthetic command that reproduces the issue;
• expected native behavior and actual CX behavior;
• whether passthrough or insights were enabled;
• affected files, database rows, or artifact paths without secrets;
• impact and any known workaround.

We will acknowledge a report, reproduce it against the current release, and coordinate disclosure after a fix is available.

Security reports are especially valuable for:

• unintended shell execution or command injection;
• argv rewriting that changes command behavior;
• wrong exit codes or stderr loss;
• secret leakage through command text, reports, exports, process summaries, or failure artifacts;
• redaction bypasses;
• path traversal or unsafe capture and artifact paths;
• capture-file retention or permission issues;
• destructive insights migrations or installer behavior;
• evidence linked to the wrong invocation or report;
• recursive CX execution or routing-policy bypass;
• unsafe archive or SQLite input handling.

Local invocation metrics and redacted command shapes are enabled by default. CX has no vendor analytics service or remote telemetry path. Readable command text and argv JSON, source labels, actionable failure details, and bounded failure responses are also recorded locally by default. General response previews remain disabled. Each recording category can be disabled separately. Redaction is conservative and cannot guarantee that all sensitive values are removed. Users can disable passive invocation recording with record_invocations=false or all insights writes for one process with CX_DISABLE_INSIGHTS=1. Failure artifacts and the local database can contain sensitive command output, so protect them like development logs.

Automatic pre-execution scanning and blocking are disabled by default. Enable them explicitly with cx insights settings --set antivirus=true; use antivirus=false to disable them again. Recording settings do not enable antivirus, and an old firewall row does not count as opt-in. Manual cx security scan remains available independently. The scanner is a bounded static check, not a process sandbox or a guarantee that code is safe.