SkillRewind is a v0.3 alpha research and integration preview. It has not undergone external security review and should not be deployed against production credentials, untrusted third-party artifacts, or live agent traffic without further hardening. See docs/threat-model.md for the full trust-boundary analysis this policy summarizes.

Please report suspected vulnerabilities privately rather than opening a public issue. Open a GitHub security advisory on this repository (Security tab → "Report a vulnerability"), or contact the maintainer directly through the contact information in CITATION.cff. Include:

• a description of the vulnerability and its potential impact;
• reproduction steps or a minimal proof of concept;
• the affected version/commit.

We will acknowledge reports within a reasonable timeframe and coordinate disclosure before any public write-up. Please do not publish exploit details for a newly discovered vulnerability before a fix is available.

• No arbitrary-code sandboxing. The SandboxedSubprocessRunner (skillrewind.replay.sandbox) does not provide real network-namespace isolation. It sanitizes the environment and applies CPU/memory/process rlimits on POSIX, but a process inside it can still make outbound network calls if the underlying OS permits it. Only allowlisted, trusted fixture recipes should ever be routed through it. Prefer DeterministicFixtureRunner for anything not fully trusted. There is no Docker-based, network-off replay runner in this release.
• PostgreSQL is schema/ORM-portable but not live-validated in this environment. Service mode's SQLAlchemy models and Alembic migrations run against SQLite in this repository's own test suite because no Docker daemon is reachable here (docker info fails to connect to the socket — see tests/integration/test_service_persistence.py::test_docker_daemon_status_is_honestly_recorded). Two tests are honest, explicit skips for this reason, not silently omitted. Do not treat SQLite-only test runs as proof of PostgreSQL production readiness; validate against a real PostgreSQL instance before relying on Service mode's PostgreSQL path in production.
• API keys are bearer secrets. Authorization: Bearer srw_<prefix>_<secret> grants everything its scopes allow for as long as the key is valid. Keys are stored hashed (Argon2id) server-side, but the plaintext is shown exactly once at creation (POST /api/v1/admin/api-keys) and must be stored securely by the caller. Revoke a compromised key immediately via DELETE /api/v1/admin/api-keys/{key_id}; revocation takes effect on the next request (no cached-validity window).
• Ed25519 private keys generated by skillrewind attest-keygen are written with 0600 permissions but are otherwise unprotected (no OS keychain integration). Do not commit them; .skillrewind/keys/ should be gitignored in any project that uses this tool.
• Untrusted artifact content. The candidate scorer and verification suites operate on content you provide; malicious SKILL.md frontmatter is parsed with yaml.safe_load (not yaml.load) specifically to avoid arbitrary object deserialization, but always review skills from untrusted sources before ingesting them.
• No claim of model unlearning. SkillRewind revokes and rebuilds artifacts (skills, memories, prompt patches, etc.) in its own content-addressed store. It does not and cannot erase parameters, gradients, or training-time influence from any foundation model — every attestation's bounded_claims field states this explicitly (skillrewind.attestation.builder).

See docs/threat-model.md for the complete trust-boundary breakdown, including what SkillRewind does not protect against.