Vulnerability disclosure¶
How to report a security vulnerability in CodeNavi, what's in scope, the response timeline, and how to verify the release signing key. The policy applies to CodeNavi 1.3.x; the machine-readable version is at codenavi.com/.well-known/security.txt.
No paid bug bounty
CodeNavi does not offer monetary compensation for vulnerability reports. We do offer safe harbor for good-faith research and we credit reporters in the release notes. Include full technical details in your first email — reports that withhold the finding pending a fee or a call will not be triaged.
Reporting a vulnerability¶
Report privately by email to [email protected]. The same contact is published as an RFC 9116 security.txt at codenavi.com/.well-known/security.txt and served by every running instance at /.well-known/security.txt (unauthenticated, product-generic). There is no public issue tracker for CodeNavi security issues; please do not disclose publicly before we have confirmed the issue and shipped a fix.
Include:
- A description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Impact assessment — what an attacker could actually achieve
- A suggested fix, and a CVSS 3.1 severity self-assessment (both optional, both helpful)
Scope¶
| In scope | Out of scope |
|---|---|
| The CodeNavi server, CLI, and chunkers | Your own indexed source code — CodeNavi processes it, but bugs in your code are not CodeNavi vulnerabilities |
| The signed CodeNavi container image distributed with the install package | The host operating system, Docker/Podman daemon, or container runtime |
| Default configuration files and example settings | Network-level attacks against deployments bound to a non-localhost address — an operator responsibility |
| The bundled Claude Code / Codex / Antigravity plugins | Denial of service by resource exhaustion — expensive tools are rate-limited, but full DoS resistance requires enabling auth and fronting the server appropriately |
The CodeNavi release signing key (cosign.pub) and the signed update flow |
Bugs in upstream dependencies — report those upstream; we track and bump on disclosure |
Response timeline¶
| Stage | Timeline |
|---|---|
| Acknowledgment | Within 48 hours (calendar) |
| Initial assessment | Within 5 business days |
| Fix or mitigation | Within 30 days for critical/high severity (CVSS ≥ 7.0); best effort for medium/low |
| Public disclosure | Coordinated with the reporter, typically 90 days from confirmation |
Published advisories¶
Fixed vulnerabilities are recorded in Security advisories — one CN-SA-YYYY-NNN record per issue with affected versions, impact, CVSS 3.1 severity, fix and action. The release notes name the advisory in the Security section of the release that ships the fix.
Supported versions¶
| Version | Supported |
|---|---|
| 1.3.x | Yes (current) |
| 1.2.x | Best effort — critical fixes only |
| < 1.2 | No |
Safe harbor¶
We will not pursue legal action against security researchers acting in good faith and in accordance with this policy, following the principles of the disclose.io safe-harbor framework. Good faith means: only testing against your own installation, not accessing or exfiltrating other people's data, not degrading our services, and giving us a reasonable window to fix the issue before disclosing it.
Verifying the release signing key¶
CodeNavi image tarballs and update manifests are cosign-signed with the CodeNavi release key. The public key (cosign.pub) ships inside the install package — convenient, but it means a tampered package could substitute the key alongside the artifacts and every signature would still verify.
The defense is an out-of-band fingerprint check. The canonical fingerprints are published only at codenavi.com/security — deliberately a single location, on a different channel than the package. Compare the key you received against them before trusting a signed install or update:
sha256sum cosign.pub
# compare against the sha256(cosign.pub) value published on codenavi.com/security
openssl pkey -pubin -in cosign.pub -outform DER | sha256sum
# compare against the sha256(DER pubkey) value published there
A mismatch on either line means the key in your package is not the CodeNavi release key. Stop, do not install, and contact [email protected].
Security architecture¶
CodeNavi defends in depth against four primary threats: secret and PII leakage into an LLM context window, prompt injection hidden in code and documentation, supply-chain compromise, and unauthorized access to the MCP server. The Security features page walks the pipeline; the Security model explains the scanner. The full architecture, threat model, and disclosure policy also ship as SECURITY.md in every CodeNavi package.