Security

Offline-first: product analysis is designed for zero outbound repository-data egress after installation.

• No telemetry or hosted LLM calls in repository analysis.
• Evidence is redacted at construction.
• Path containment and traversal checks protect file access.
• Rule evaluation includes ReDoS and size guards.
• Dashboard defaults to loopback with CSP.
• v0.5 containment delta: link-aware output guard with symlink/junction escape audit and proven-gap-only repair; MCP remains read-only.