| Version | Supported |
|---|---|
| 0.3.x | ✅ |
| < 0.3 | ❌ |
Do not open a public issue for security vulnerabilities.
Please report security issues privately via GitHub Security Advisories: https://github.com/wzhongyou/baize/security/advisories/new
You will receive a response within 48 hours. We will work with you to understand the scope, reproduce the issue, and prepare a fix.
- Description of the vulnerability
- Steps to reproduce
- Environment details (OS, Go version, etc.)
- Potential impact
- Reporter submits vulnerability privately
- Maintainer acknowledges within 48 hours
- Fix is developed and tested
- CVE is requested if applicable
- Public disclosure after patch is released
Baize is built with security as a core design principle:
- OS-Native Sandbox — macOS Seatbelt / Linux Bubblewrap for process isolation
- Permission Pipeline — deny-first model, all tool calls go through permission checks
- Local-First — API keys and session data stay on your machine
- No Telemetry — no usage data leaves your machine (by default)
See docs/subsystems/permission.md for details on the permission system.