Skip to content

Security & Reliability

Core Invariants

  • Zero-Knowledge Processing: All scanning and redaction occurs on local hardware before data leaves the system boundary.
  • ReDoS Immunity: All pattern matchers utilize finite automaton evaluation with linear time guarantees.
  • Path Traversal Isolation: File operations are strictly locked within workspace boundaries.
  • Memory Safety: Implemented in safe Rust with bounded stream readers (.take()) preventing resource exhaustion attacks.
  • Audit Verification: Continuous dependency auditing via RustSec advisory databases.

Vulnerability Disclosure

Please refer to the full SECURITY.md for vulnerability disclosure procedures.