Security fixes are provided only for the latest minor release line. Older minor releases are not supported.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via email to the maintainers:

Email: [logicstamp.dev@gmail.com]

You should receive a response within 48 hours. If for some reason you do not, please follow up via email to ensure we received your original message.

Please include the following information with your report:

• The type of issue (e.g., buffer overflow, SQL injection, cross-site scripting, etc.)
• Full paths of source file(s) related to the manifestation of the issue
• The location of the affected source code (tag/branch/commit or direct URL)
• Any special configuration required to reproduce the issue
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit the issue

This information will help us triage your report more quickly.

After you submit a security report:

1. Acknowledgement: We'll acknowledge your email within 48 hours and provide a more detailed response within 7 days indicating the next steps in handling your report.

2. Verification: We'll verify the issue and determine its severity and impact.

3. Fix Development: If accepted, we'll develop a fix in a private repository to prevent premature disclosure.

4. Release: We'll release a patch version addressing the vulnerability and credit you for the discovery (unless you prefer to remain anonymous).

We appreciate your efforts to responsibly disclose your findings and will make every effort to acknowledge your contributions.

This security policy applies starting from LogicStamp v0.4.0.

This security policy currently applies to LogicStamp Context (CLI / local mode only).

LogicStamp Context (CLI) is designed as a local, standalone tool that:

• Runs entirely on the user's machine
• Does not send source code or metadata over the network
• Does not integrate with any LLMs or external services

The local CLI is intended to remain a fully functional, offline-first tool.

Future versions of LogicStamp may introduce separate, optional cloud or team-based products (such as shared analysis or LLM-assisted workflows). These features will:

• Be opt-in only
• Be delivered as separate services or modes
• Be documented under their own security and privacy policies
• Clearly disclose what data is transmitted, stored, or processed remotely

This document applies only to the local CLI unless explicitly stated otherwise and will be updated if the scope changes.

When using LogicStamp Context:

• Scan trusted codebases only: The tool reads and processes your source code. Only run it on codebases you trust.

• Automatic file creation: The tool automatically creates context.json files (one per folder containing components) and a context_main.json index file in your project directory when you run stamp context. Be aware of where these files are created and review them before committing.

• Automatic .gitignore modifications: The stamp init command automatically adds patterns to your .gitignore file (or creates one if it doesn't exist) by default. It is non-interactive by default (no prompts) because the security scan runs automatically. If you use --no-secure, it will prompt you interactively (in TTY mode) to confirm before adding patterns. Your preference is saved for future runs. The stamp context command respects these preferences and never prompts (CI-friendly). The following patterns are added:

  • context.json - Per-folder context bundles generated by stamp context. These are large JSON files containing component contracts and dependency graphs. They're regenerated on each run and don't need to be versioned.

  • context_*.json - Main index file (context_main.json) and other context variants. The main index provides a directory overview of all context files. Like context.json, these are regenerated and can be large.

  • context.toon and context_*.toon - TOON format context bundles generated when using --format toon. These are alternative output format files (similar to JSON but in TOON format) that are regenerated on each run and don't need to be versioned.

  • *.uif.json - UIF (User Interface Format) contract files. These are generated contract sidecars that may be created by other LogicStamp tools. They're build artifacts and don't need to be committed.

  • logicstamp.manifest.json - Dependency manifest files that track project dependencies. These are generated metadata files that can be regenerated.

  • .logicstamp/ - Configuration directory containing user preferences (config.json) and potentially cache files. This directory stores local settings and shouldn't be committed.

  • stamp_security_report.json - 🔒 SECURITY CRITICAL: Security scan report file generated by stamp security scan. This file only contains sensitive information if secrets are actually detected (file locations, line numbers, code snippets). If no secrets are found, the report will have secretsFound: 0 and an empty matches: [] array. Note: Secrets should not normally be present in TypeScript (.ts, .tsx), JavaScript (.js, .jsx), or JSON (.json) source files—they should be stored in .env files or environment variables. The security scan checks for secrets that may have been accidentally committed to source files. This file should never be committed to prevent exposing security findings. Critical: Even if you don't run stamp init, stamp security scan automatically ensures this file is in .gitignore to protect sensitive findings. This behavior is intentional and enforced to prevent accidental leakage of sensitive information into version control. Never commit security reports to version control. If no secrets are detected, the report contains no sensitive data and is safe to inspect locally.

  These patterns prevent large generated files and sensitive reports from being committed. Review these changes to ensure they align with your project's needs. See docs/cli/init.md for detailed explanations of each pattern.

• Automatic LLM_CONTEXT.md creation: The stamp init command automatically creates an LLM_CONTEXT.md file in your project root by default. It is non-interactive by default (no prompts) because the security scan runs automatically. If you use --no-secure, it will prompt you interactively (in TTY mode) to confirm before creating the file. Your preference is saved for future runs. The stamp context command respects these preferences and never prompts (CI-friendly). Review this file to ensure it contains appropriate information for your project.

• Review generated context: Before sharing context.json files, review them to ensure they don't contain sensitive information (API keys, passwords, etc.).

• Keep dependencies updated: Regularly update logicstamp-context and its dependencies to receive security patches.

🔒 Sensitive Data / Credentials Handling

Automatic Secret Sanitization (v0.3.0+): LogicStamp Context automatically sanitizes secrets in generated context files when a security report exists. When you run stamp context or stamp context style, if stamp_security_report.json exists, any secrets detected by the security scanner are automatically replaced with "PRIVATE_DATA" in the generated JSON files. Your source code files are never modified - only the generated context files contain sanitized values.

Important: Credentials can only be included in generated bundles when using --include-code full mode. The other modes (none, header, header+style) only include metadata and contracts (with secrets sanitized), not actual implementation code where credentials would typically be found.

Security Scanning: Use the stamp security scan command to detect secrets in your codebase before generating context files. After scanning, review the security report and manually add files containing secrets to .stampignore using stamp ignore <file> to prevent them from being included in context compilation. See docs/cli/security-scan.md for complete documentation.

Best Practice: We strongly recommend avoiding hard-coded credentials and using environment variables or secret management tools. Even with automatic sanitization, it's better to keep secrets out of source code entirely.

LogicStamp Context:

• Reads source code: The tool parses your TypeScript source files (frontend and backend frameworks) using AST analysis. It does not execute your code.

• Never modifies source code: LogicStamp Context never modifies your existing source files. It only generates new output files (context.json, etc.) and may modify .gitignore (only adds patterns, never removes anything) or create LLM_CONTEXT.md automatically (by default) or with your approval (when using --no-secure flag).

• No LLM usage: LogicStamp Context does not use any LLM internally. All analysis is performed through deterministic AST parsing and local static analysis only.

• No network access: The tool operates entirely offline and does not make network requests.

• No code execution: LogicStamp Context only analyzes code statically; it never executes your code.

• CI-safe: LogicStamp Context is safe to run in CI environments because it does not execute user code or make network requests.

• Local file access: The tool reads files from your local filesystem based on the scan path you provide.

LogicStamp Context validates generated context bundles against the official JSON schema at load time.

Invalid, malformed, or schema-drifted contract files are rejected early to prevent corrupted or outdated architectural context from being consumed by tooling or AI agents.

This validation step ensures structural integrity and deterministic behavior across versions.