This repository is the v0.4.4-pre-dyson archival snapshot of Cerebra. Only the tagged commit v0.4.4-pre-dyson is supported; security patches will be applied on top of that tag if they affect the runnable baseline. Active development continues at bitmosh/cerebra, which is the appropriate place to report issues affecting current versions.

Please report security issues privately rather than opening a public issue:

1. Use GitHub's private vulnerability reporting on this repository.
2. Or contact the maintainer directly via GitHub (@bitmosh).

Expect a response within seven days. Because this is an archival fork, fixes will be released as patches on top of the v0.4.4-pre-dyson tag rather than as a new minor version.

Reports are in scope if they affect Cerebra at its archive state. Examples:

• Vulnerabilities in pinned dependencies that the archive depends on
• Vulnerabilities in optional dependencies (e.g. fossic when installed via the [fossic] extra) — report to those projects directly. Cerebra's scope is only its own code.
• Privilege-escalation or data-exfiltration issues in the runtime itself

Out of scope:

• Issues fixed in later Cerebra versions (report at the main Cerebra repository)
• Issues only reproducible in non-archival forks or modifications

Cerebra's runtime scope is intentionally narrow:

• No credentials or network-accessible user data are handled
• The vault is local filesystem only; no cloud sync
• LLM calls go to a local Ollama instance; no external API traffic by default
• The HTTP daemon (cerebra serve) binds to localhost only