Markdown Brain operates on directories that may contain private notes, credentials, or client information. Security reports involving unexpected file modification, path traversal, secret exposure, backup integrity, or cross-vault data leakage are taken seriously.

The latest commit on main is the supported version until formal versioned releases are introduced. Security fixes are applied to main and documented in the associated commit or release notes.

Do not open a public GitHub issue for an unpatched vulnerability.

Use GitHub's private vulnerability reporting for this repository if the option is available under the Security tab. Otherwise, contact the maintainer privately through arnold.gamboa.ph.

Include:

• A concise description of the vulnerability
• The affected command, file type, or workflow
• Reproduction steps using a sanitized test vault
• The impact you observed or believe is possible
• Any suggested mitigation

Do not send real credentials, private notes, client data, or a complete personal vault. Build the smallest sanitized reproduction you can.

You can expect an acknowledgement within seven days. The maintainer will assess severity, reproduce the issue, and coordinate disclosure when a fix is available. Timelines may vary depending on complexity.

• Back up a vault before bulk normalization.
• Keep backups outside the vault and out of Git.
• Review dry-run output before using --apply.
• Keep secrets out of Markdown notes when possible.
• Use separate vaults for separate clients or trust boundaries.
• Review changes with version control or a directory diff.
• Run validation after maintenance.

The project cannot protect data that has already been committed to a public repository. If a secret is exposed, rotate it immediately and then remove it from Git history.