The published evaluation version is v0.2.4; its wheel, source archive, and checksums are bound in the public verification record. The current source/package identity is 0.2.5, unreleased. Maintenance is bounded owner-led upkeep, with no support-service, response-time, or security-resolution promise. See the supported environment and engineering coverage. ScopeProof is local-first, public-repository-only, and does not accept or require credentials beyond an optional GitHub token kept in the active local session.

Do not post security vulnerabilities in public issues, pull requests, or discussions. Use GitHub's private vulnerability report for this repository and include a concise reproduction, affected version or commit, impact, and any safe mitigation you identified.

Do not include tokens, private repository links, customer data, or other confidential source material in a report.

Reports are most useful for local review storage, public GitHub ingestion, workflow isolation, deterministic evidence handling, exports, and dependency or supply-chain behavior. ScopeProof does not currently provide hosted, private-repository, billing, or paid-LLM features.

For ordinary reproducible defects, use the sanitized defect form. Evaluation downloads require no participant case or qualifying review.