Security

Report a CrewScore vulnerability privately.

CrewScore is an offline static-analysis tool. Please report concrete security issues privately, especially ones involving prompt text, source URLs, analytics, the GitHub Action, publishing, or dependencies.

Report a vulnerability on GitHub

If GitHub is unavailable, email sarosh@pendoah.ai. Do not post secrets, customer prompts, or exploit payloads in a public issue.

What to include

Share the affected version or commit, a minimal synthetic reproduction, impact, and any suggested mitigation. We will acknowledge the report, assess scope, and coordinate a fix and disclosure timeline with the reporter.

Current project safeguards

• Prompt text stays in the browser during website scoring; see privacy details.
• Package publication uses PyPI Trusted Publishing rather than a stored publishing token.
• Release artifacts are built, tested, and smoke-tested before publication.
• GitHub secret scanning, push protection, Dependabot alerts, and Dependabot security updates are enabled.
• Dependabot pull requests run on ephemeral GitHub-hosted runners; routine project checks use an isolated maintainer-runner boundary.

Scope and limits

Reports may cover the Python package, GitHub Action, static site, generated browser engine, build and release automation, or published dependencies. A false positive or missing written control is normally a scoring-quality issue, not a security vulnerability.

CrewScore is not a security certification and does not prove an AI agent will follow written instructions. It checks whether guardrails are written down; runtime enforcement and adversarial testing remain separate.