If you discover a security issue in Pinion, please do not open a public GitHub issue. Instead, report it privately:

1. Open a GitHub security advisory, or
2. Email the maintainer through the address listed on https://github.com/namojo (use the GitHub profile to find current contact).

You should expect an acknowledgment within 7 days. We will work with you on a timeline for a fix and coordinated disclosure.

Security-relevant areas of Pinion:

• Sandbox isolation (pinion/sandbox.py, pinion/_sandbox_driver.py) — process-level isolation, network kill-switch, resource limits, env scrubbing. Note: this is not a security boundary against malicious code (see docs/SPEC.md §10.1). Run Pinion only on code you trust.
• LLM provider routing (pinion/providers.py, pinion/llm_client.py) — ensures API keys are read from env, never logged, and never written into emitted test files.
• Generated test files — pinned tests are deterministic Python source. They should never embed live API keys, secrets, or untrusted URLs.
• Sandbox subprocess command line — uses an explicit fixed argv (no shell, no string concatenation).

The following are documented limitations rather than security bugs:

• Sandboxing untrusted / malicious code. Pinion's sandbox protects you from runaway loops and accidental I/O, not from a determined attacker. This is explicit in the README and SPEC.
• Windows resource limits. resource.setrlimit is POSIX-only; Windows runs in best-effort mode.
• LLM provider trust. If your provider mis-handles your prompts, that is the provider's incident, not Pinion's. We do not embed your prompts in our telemetry.
• API keys leaked by third-party tools (your shell history, IDE auto-save, accidental commits). Treat keys like passwords; use .env files and secret managers.

We currently support security fixes only on the latest published version. Older versions are best-effort and may require upgrading. The latest is visible at https://pypi.org/project/pinion-mcp/.

Once a fix is released, we will acknowledge the reporter in the release notes (unless they prefer to remain anonymous).