Security fixes ship as a new release; older releases are not patched. Please reproduce against the latest release before reporting.

Email security@glassity.cloud. Do not open a public GitHub issue for a suspected vulnerability.

Please include:

• What you found and why you believe it is a security issue.
• Steps to reproduce, ideally with the exact commands.
• glassity --version, your operating system, and how you installed the binary.
• Any logs or output, with tokens redacted.

We will acknowledge your report and keep you updated as we investigate. Please give us a reasonable window to ship a fix before disclosing publicly.

This binary handles authentication material. Reports touching the following are in scope:

• Credential handling. Personal Access Tokens and OAuth access/refresh tokens, their storage in the OS keychain, the GLASSITY_TOKEN environment path, and the short-lived token file used to hand credentials to the glassity fs daemon.
• Credential leakage. Tokens appearing in stdout, stderr, logs, process arguments, the process environment of a child process, or files with permissions that are too broad.
• The two-phase confirmation flow. Anything that lets a mutation reach the wire without being rendered first, or that lets the transmitted request differ from the request shown in phase 1. This includes the confirm-token HMAC, the on-disk secret files, and their lifecycle.
• Filesystem mount safety. Path traversal or mountpoint handling in glassity fs that could overwrite or expose data outside the mount.
• Local privilege issues. Insecure file permissions, predictable paths, or time-of-check/time-of-use races in the config, cache, state, or runtime directories.
• Dependency vulnerabilities that are reachable from this binary's code paths.

Out of scope:

• Vulnerabilities in the Glassity server or web application. Report those to the same address; they follow a separate process.
• Findings that require an attacker who already has arbitrary code execution as the user running glassity.
• Missing hardening flags with no demonstrated impact.
• Reports produced solely by automated scanners with no analysis of exploitability.