Report a problem.
Found a vulnerability? Report it privately with a GitHub security advisory, or email hello@shaileshjha.in. For bugs and ideas, open an issue on GitHub.
Report a vulnerability
Private GitHub security advisory, as SECURITY.md asks. Please don’t open a public issue for it. You can also email hello@shaileshjha.in.
prism --version. A small reproduction helps most. Please leave out real source code, tokens and .prism/ contents from a private repo.What to expect
working days to acknowledge
working days to assess, with a severity and a plan
days to fix or mitigate a high-severity issue
Targets from SECURITY.md. Prism is maintained by one person, so these are targets rather than a staffed rotation. You are credited in the release notes unless you ask not to be.
No account, no keys
Nothing to sign in to. No credential is written.
Secrets refused
Habit steps that look like secrets are refused before they are saved.
Local server
prism install points your agent at the Prism server on your disk, so nothing is fetched when it starts. The hand-added snippet uses npx, which downloads the published package from npm.