Skip to content

docs(v1): clarify current security verdict and contributor scope #185

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
aetherxeg-source merged 2 commits into from
Oct 8, 2026
Merged

docs(v1): clarify current security verdict and contributor scope #185

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2f88683
docs(v1): align security verdict and contributor intake with current …
aetherxeg-source Oct 8, 2026
0c8fc8e
docs(v1): align security verdict and contributor intake with current …
aetherxeg-source Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion CONTRIBUTING.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,8 @@

ExecSurface prioritizes precision, reproducibility, explicit limitations, and evidence-preserving engineering.

**Current supported public release:** `v1.0.0` within the documented Linux x86_64/native-`ptrace` contract. Older Alpha.5 contribution tasks and examples remain useful historical evidence, but they must not be presented as the current stable consumer path without a new exact-v1 run, public artifact verification and fresh CI.

## New to ExecSurface?

Start with repository Issues labeled `good first issue` and `help wanted`.
Expand All @@ -16,7 +18,7 @@ Current newcomer-scoped entry points include:

These tasks are intentionally bounded so contributors can improve usability and integrations without silently changing runtime semantics, evidence authority, support claims or release guarantees.

Independent Alpha.5 evaluation and adversarial findings belong in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). A contribution or self-test is valuable engineering work, but it is not automatically independent external validation.
Independent Alpha.5 findings remain preserved in [Issue #118](https://github.com/AETHERXGLOBAL/execsurface/issues/118). Current real-workload post-v1 evidence is tracked in [Issue #140](https://github.com/AETHERXGLOBAL/execsurface/issues/140). A contribution or self-test is valuable engineering work, but is not automatically independent external validation or product adoption.

## Before opening a change

Expand Down
6 changes: 3 additions & 3 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,14 +6,14 @@ ExecSurface is a security-adjacent developer tool.

ExecSurface is not a sandbox, EDR, antivirus or malware detector.

A future PASS verdict will mean only that under the recorded observer, normalization profile, baseline and policy, no disallowed execution-surface expansion was identified.
In the current **Stable v1.0.0** Linux x86_64 / native-`ptrace` contract, an ExecSurface `PASS` means only that under the selected observer, normalization profile, baseline and policy, no policy-relevant observed execution-surface drift was identified. It does **not** prove that the wrapped target command exited successfully: target exit status/signal are recorded separately and are not verdict-bearing in v1.0.0.

It will not prove that a program is safe or that unobserved behavior is impossible.
It does not prove program safety, sandboxing, malware freedom, fair benchmarking, determinism or completeness of all unobserved behavior. Keep the wrapped command's own success/failure gate when its correctness matters.

## Sensitive data

Evidence and traces can be sensitive. Default product semantics prohibit collecting file contents, environment values, stdin, network payloads and full child argv values.

## Vulnerability reports

Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them.
Use GitHub private vulnerability reporting when available. Avoid publishing exploitable details in a public issue before maintainers can assess them. For experimental external-trial tooling, the reported CI-output privacy boundary and its reviewed remediation are retained at [Issue #164](https://github.com/AETHERXGLOBAL/execsurface/issues/164); old pinned trial packet revisions do not receive fixes retroactively.