Security and Vulnerability Disclosure
Last updated: 2026-11-10.
If you believe you have found a security vulnerability, please tell us privately before you tell anyone else. This page says what is covered, how to report, and what to expect.
What is in scope
- This website, codifide.com, including the small server functions under
/apiand/symbols. - Codifide’s public repositories: the Codifide Direttore harness (including its enforcement scripts and any steering text that could lead an agent to take an unsafe action) and the Codifide Programming Language.
What is out of scope
- Codifide Gregario. It is private and in development, and there is nothing public to test.
- Third-party services and tools: GitHub, Vercel, Google Fonts, AI coding assistants and their hook runtimes. Please report problems in those to their owners.
- Denial-of-service testing, social engineering, and physical attacks.
- Behaviour the documentation already marks as advisory or unverified. The enforcement table says which controls are mechanical and which are conventions.
How to report
- The website: email info@codifide.com with the subject “Security”. Include the URL, what you did, and what you saw. There is no PGP key.
- The public repositories: GitHub private vulnerability reporting is enabled on both. Open the repository’s Security tab and choose “Report a vulnerability”. The harness policy is in its SECURITY.md.
Please do not post exploit details in public issues, pull requests, or social media, and please do not access, change, or keep data that is not yours.
What to expect
Codifide is a small company. A person reads each report and replies by email or in the GitHub advisory. No response-time commitment, bug bounty, or legal safe harbor is offered. If a report leads to a fix, we will say so, and we will credit you if you want to be credited.
The machine-readable contact is at /.well-known/security.txt.
Informational only. Not legal, medical, regulatory, security, or compliance advice. Provided as is, without warranty. See Notices.