Email security@scriptkittyos.com. Please do not open a public issue for a suspected vulnerability.

Include what you did, what happened, and what you expected. A proof of concept helps; a working exploit is not required and is not expected.

You will get an acknowledgement within 14 days, and in practice sooner. Trinity is maintained by the people named in MAINTAINERS.md and has no paid security staff, so that is the target the project holds itself to rather than a contractual commitment; if you have not heard back in 14 days, send the report again.

We ask for coordinated disclosure: give the project a reasonable period to publish a fix before disclosing publicly, and we will credit you in the release notes unless you ask otherwise.

Advisories against dependencies are tracked openly rather than left implicit. Dependency and licence audits run on every commit, and automated dependency alerts are enabled on the repository. Where an advisory cannot be resolved immediately, it is recorded in docs/06-risk-register.md with the reason, the owner and the condition that lifts it, and the scope of what it does and does not affect is stated.

Trinity is a local-first desktop agent. The interesting surfaces are the permission gate, the effect membrane, the receipt chain, the MCP server's authorization, and the sandbox.

The BEAM is not an OS sandbox, and the plan says so in docs/07-security-model.md rather than implying otherwise. The shell tool's child-kill guarantee is platform-dependent and is stated per platform. A receipt signed by a key held in a file proves the chain was not altered after the fact; it does not prove custody of the key.

Pre-release. No version is supported yet; there has been no release.