We take the security of PoCumentary seriously and appreciate your help in keeping it safe.

A demo.toml executes arbitrary commands on your host by design — only run specs you wrote or have read, and isolate anything untrusted as you see fit. You are responsible for what you choose to run. See Running demos safely in the README.

Please do not open a public issue for security vulnerabilities. Instead, report them privately in one of two ways:

• Email — send the details to research@pillar.security.
• GitHub Security Advisory — open a private report via the Security Advisories page for this repository.

Please include as much detail as you can:

• a description of the issue and its impact,
• the affected version or commit,
• steps to reproduce (a minimal demo.toml or command is ideal), and
• any suggested remediation.

We will acknowledge your report, keep you updated on our progress, and coordinate a disclosure timeline with you once a fix is available.