Skip to content

Repository navigation

Security: sageox/frictionax

Security

SECURITY.md

Security Policy

Reporting a vulnerability

Please report security vulnerabilities privately — never open a public issue. Use this repository's private vulnerability reporting: Security → "Report a vulnerability" on GitHub. (If that option is not visible, a maintainer must enable Private vulnerability reporting in repo settings — until then, email security@sageox.ai.)

frictionax is a public Go CLI for CLI friction detection — flag issues in argument handling, telemetry, or the released binaries.

We aim to acknowledge within 3 business days. For confirmed high/critical issues we coordinate a fix and publish a GitHub Security Advisory (and a CVE) only after the fixed release ships.

Please do not

  • Do not disclose the issue publicly (issues, discussions, social) before a fix.
  • Do not run automated scanners or load tests against production systems.

This repository is covered by the SageOx continuous security program (see sageox/sageox-monorepo security/, ADR-204).

There aren't any published security advisories