KeyWraith is defensive-security research. This policy covers the security of the software itself; the responsible-use rules for the research (only test hardware you own, benign payloads only, consented and de-identified human data) live in docs/threat_model.md and are equally binding.

Please report suspected vulnerabilities privately via GitHub's Security Advisories ("Report a vulnerability"). Do not open a public issue for a security problem.

Include: affected version/commit, a description, and reproduction steps. Expect an acknowledgement within a few days. Please allow a reasonable window to release a fix before any public disclosure.

This is a research project; only the main branch (latest commit) is supported.

• Model files are pickles. scikit-learn serializes estimators with pickle, and unpickling executes arbitrary code. Treat a .pkl model as executable.
  • BehavioralDetector.save() writes a <model>.sha256 integrity sidecar.
  • BehavioralDetector.load() verifies that digest by default and refuses to unpickle a file whose hash does not match (tamper/corruption detection). It also refuses trusted=False. This is integrity, not authenticity — only load models from a source you trust.
• No untrusted deserialization of data. Datasets are plain NDJSON/CSV of numeric timing features; loaders build typed objects, never eval/pickle of session data.
• Input validation. The detector rejects feature matrices with the wrong shape or non-finite values before they reach the model.
• No secrets, no network. The library performs no network I/O and stores no credentials. Human captures are de-identified to timing features only; raw captures are git-ignored (see .gitignore).
• Least-privilege automation. CI and CodeQL workflows pin their triggers and request read-only GITHUB_TOKEN permissions.

Runtime dependencies are the mainstream scientific Python stack (numpy, pandas, scikit-learn, matplotlib). Dependabot monitors them; CodeQL scans the Python source on every push.