Report suspected vulnerabilities privately so maintainers can investigate before exploit details become public. Don't open a public issue, pull request, or discussion for a vulnerability.

Security fixes target these versions:

Legacy query artifacts are rejected from bounded builder metadata. Builder versions are compatibility claims, not authenticated identities. Recovery commands use only the selected snapshot's sibling source-root.txt, bounded to 16 KiB and checked as a regular, non-symlink file containing an absolute, existing directory. Control characters and parent traversal are rejected; displayed roots are canonicalized and shell-escaped. Invalid or absent provenance requires the caller to supply a root. Compass displays this command; it does not execute it automatically or rewrite historical artifacts.

Use GitHub private vulnerability reporting. If the private reporting form isn't available, wait for the repository owner to enable it rather than publishing exploit details.

Include the information that helps reproduce and assess the problem:

• Affected Compass version or commit
• Operating system and installation method
• Vulnerable command, input, or integration
• Reproduction steps or a minimal proof of concept
• Expected and observed behavior
• Potential impact and affected data
• Suggested mitigation, if you have one

Remove API keys, database passwords, private source code, and unrelated personal data from the report.

Give maintainers time to reproduce, assess, fix, and publish an advisory before sharing details elsewhere. The project doesn't promise a fixed response or release time because severity and remediation scope vary.

Maintainers will use the private advisory to coordinate questions, credit, affected versions, mitigations, and publication. A report may be closed when it doesn't cross a security boundary or can't be reproduced from the supplied information.

Compass parses untrusted project content and graph files. Its default structural build and query workflow stays local, but these opt-in features cross process or network boundaries:

• Semantic extraction sends selected content to the configured model provider
• Stateless MCP 2026-07-28 Streamable HTTP exposes the server on the configured interface; every request remains independently subject to host validation, authentication when configured, and body limits
• Legacy MCP 2025 Streamable HTTP creates server-side sessions after host and configured API-key validation. Compass serializes admission and retains at most 64 simultaneous legacy sessions; further initialize requests receive HTTP 429 / MCP -32024 until a session closes or expires. Deployments that bind beyond loopback should require an API key even though the capacity bound also applies to unauthenticated servers.
• Agent Graph mutation is a separate opt-in capability. HTTP deployments must use distinct non-empty read and write API keys, canonical project allowlists, and server-owned principals/permissions. The write tool is absent when disabled; mask capability must be enabled separately. Never place prompts, responses, chain-of-thought, credentials, or source excerpts in audit metadata.
• Neo4j and FalkorDB pushes connect to external databases
• URL acquisition and Google Workspace extraction access configured external services
• PostgreSQL extraction connects to the supplied database server
• Assistant setup can register local command hooks. Review generated hook files before trusting them in the host, and reinstall after moving the Compass executable so the managed command path remains accurate.
• compass agent export publishes only the embedded seven-skill collection and credential-free native MCP configuration. compass agent validate treats bundles and managed installations as untrusted: it bounds files and bytes, rejects symlinks, escaping paths and common machine-specific roots, verifies manifests and checksums, accepts only the documented Compass stdio command or loopback HTTP endpoint, and reports likely literal credentials without echoing their values.
• compass upgrade downloads the bounded compass.release/1 manifest and the selected archive from official GitHub release URLs. It validates the schema, stable tag/version binding, bounded unique targets, selected archive name and size, SHA-256 digest, archive path, and staged executable version before replacing the running binary.
• compass review parses exact untrusted Git objects without checking out or executing their code. Its reusable Action must run in a dedicated job that has not executed contributor-controlled scripts; the write token belongs only in the pinned comment-delivery step. Fork reviews publish read-only evidence and suppress comments. Never use pull_request_target to execute a contributor head.

Include the selected options and endpoint type in reports about these features. Never include live credentials.

graph.json, store.ref, backup manifests, SQLite files, and future adapter objects are untrusted input. Compass validates schema majors, bounded sizes, content digests, active selectors, canonical JSON export, and reference bindings before exposing a store snapshot. compass store restore is fail-closed, restores only into a new destination, and removes an incomplete destination on validation failure. Stop writers before copying a redb file; the SQLite backup command checkpoints WAL for this purpose. Backup manifests are limited to 64 KiB at both metadata inspection and streaming read, before either adapter decodes them or creates a restore destination.

The namespace is an isolation and lifecycle key, not an authorization mechanism. A future hosted adapter must add authentication, authorization, TLS, audit logging, quotas, and tenant-scoped GC outside the common contract. Official release binaries include the SurrealDB remote client but configure no remote endpoint or credential by default; JSON and SQLite remain available without network access, and remote use requires an explicit engine/reference and endpoint configuration. Never attach a store database or raw backup to a public issue: it can disclose repository names, paths, source anchors, and graph structure. Share a sanitized compass store status --format json response instead.

The optional SurrealDB backend accepts only validated compass.graph/1 documents and exposes no arbitrary SurrealQL API. surreal.ref and projection bundles are untrusted, bounded inputs whose schema, graph digest, projection fingerprint, repository, generation, counts, engine, and location binding are validated before reads. Record identities are deterministic digests, statement values are parameter-bound, table selection is a closed enum, query work is bounded, and filesystem publication occurs only after the exact staged generation is validated. Queries pin the reference generation and never trust an unbound or mismatched graph digest: reference-aware staging persists the publisher's admitted digest in the immutable manifest, including after portable restore. Generation garbage collection scopes its candidate read to the publishing repository and excludes retained generations before applying the batch limit, so it cannot reclaim another checkout's data in a shared store. Queries never trust the database's mutable active pointer; query, status, validation, and backup opens do not issue schema-definition statements. Backup/restore exports typed projection records instead of copying opaque database directories.

The optional surreal-remote feature introduces an explicit network and credential boundary. Server URLs reject userinfo, query strings, fragments, and unexpected paths. Plaintext is allowed only for loopback hosts; other hosts require certificate-validated TLS. HTTP(S) endpoint spellings select the equivalent WebSocket RPC transport. Each connection/authentication has a 30-second deadline; each query RPC has a 120-second outer deadline and WebSocket messages are limited to 128 MiB, in addition to the existing semantic row/byte/deadline limits. References must match independently configured endpoint, namespace, and database before connection or authentication. Authentication errors redact credentials. Prefer protected environment variables or password/token environment selectors; YAML may contain secrets only in an operator-protected file, never committed. YAML reads are capped at 64 KiB and parser diagnostics omit input contents. CLI password/token arguments are supported but visible to process inspectors. Process configuration is immutable; restart Compass/MCP to rotate credentials. Use a dedicated Compass database and least-privilege database user. Publication defines Compass tables/indexes only there. Automatic remote generation GC is disabled because local snapshots cannot establish other machines' reader liveness; an administrator must coordinate remote reclamation. No launch-agent configuration or running server's database files are modified.

Embedded physical connections are shared only within the process by canonical store path and engine, with independent namespace/database sessions and exact generation references. A dedicated runtime retains at most 16 store owners until process exit, preventing caller-runtime teardown from stranding database locks. A caller cannot switch the engine of an already open path. This local resource ownership is not a tenant authorization boundary.

An explicit embedded storage path may be project-relative or absolute, but it may not resolve to the output container itself or beneath its immutable snapshots/ tree. Compass resolves the existing path prefix before this check so a symlinked parent cannot redirect database writes into a published snapshot.

PDF and OOXML files, XML relationships, compressed members, embedded images, model files, OCR output, and document cache entries are untrusted. Compass enforces raw/archive/member/ratio/XML-depth/document/raster limits. Raw file and cache reads remain stream-bounded if a file grows after its metadata is read. Compass rejects package traversal, duplicate normalized members, incoherent OCR origin/profile/geometry, and unknown cache fields; it never executes spreadsheet formulas or embedded objects and never follows external document links.

compass models install is the only OCR download boundary. It accepts only the pinned profile catalog, fixed HTTPS host, declared byte size, SHA-256, and at most three validated redirects to the fixed artifact host. Concurrent installation of one profile is serialized with a bounded lock. Publication uses temporary files, directory synchronization, and an atomic verified marker; model artifacts, markers, and install locks must be regular non-symlink files. Inspection, extraction, listing, verification, cache replay, and historical materialization never silently fetch or invoke an arbitrary executable. Model and document cache paths can contain sensitive derived content and should not be attached to public issues.