@takk/bayesoutputgate is a stable (1.0.0) library for calibrated output validation with the Bayes Factor. We take security reports seriously and aim to acknowledge each one within two business days.

Each published version follows strict SemVer (see SPEC.md and .github/RELEASING.md). Only the latest minor of the current major receives security patches; an older major receives critical-CVE fixes for 6 months after the next major lands.

Please do not file public GitHub issues for security problems. Send reports to davcavalcante@proton.me (preferred) or say@takk.ag (Takk relay), with the subject line beginning [SECURITY].

Include, at minimum:

• Affected version (npm ls @takk/bayesoutputgate).
• Reproduction steps or a minimal proof-of-concept.
• Impact assessment (what an attacker can achieve).
• Any suggested mitigation.

If your report involves a vulnerability in a third-party peer dependency, please also link the upstream advisory (CVE, GHSA, etc.) so we can coordinate the disclosure.

PGP / signed reports are welcome but not required. If you need an out-of-band channel, ask in the first message and we will propose one.

1. Acknowledgement within 2 business days.
2. Triage and severity assignment within 7 days.
3. Fix targeted for the next release; critical issues ship as an out-of-band patch on the affected minor.
4. Coordinated disclosure: the reporter is credited in the changelog and advisory unless they request anonymity.

Findings in any of the following are in scope:

• Audit integrity. Any way to make verifyChain return valid: true for a chain that was altered after sealing, any hash-chain construction that lets a forged entry pass, or any way to defeat the SHA-256 chaining. The seal is an integrity seal, not a signature: it proves a log was not altered after sealing, not who produced it, and that boundary is documented, not a vulnerability.
• Untrusted input parsing. Any malformed tool input, history file, score file, or audit chain that bypasses the defensive validation in the adapter or the node loaders and yields prototype pollution, an unhandled crash, or a non-finite value that propagates into a fit. Input arriving from a model through runTool and history read from disk are both treated as untrusted.
• Decision integrity. Any way to drive a numerically invalid model (NaN or Infinity where a finite number is required) past the Beta fit, or any edge case in the Bayes Factor, the decision policy, or the calibration measurement that returns a probability outside the valid range, a non-finite Bayes Factor, or an action that does not follow from the configured thresholds or losses.
• Supply chain. Tarball contamination, compromised npm scope, or a published artifact whose provenance attestation does not match the source commit.

• The correctness of the scorer you choose. BayesOutputGate weighs the scores you provide; it does not produce the scores, and it does not decide what a good output is for you.
• The correctness of the scores and labels you feed it. Garbage scores produce a garbage verdict; that is a usage concern, not a vulnerability.
• Statistical mis-modeling when the assumptions are violated (scores that are not Beta-distributed, correlated dimensions that double-count evidence, or labels that do not reflect true quality). The library documents these limits, provides goodness-of-fit and dependence diagnostics, and measures its calibration; a misleading verdict under a violated assumption is expected behavior, not a defect.
• Theoretical attacks against the cryptographic primitive used for the audit chain (SHA-256) and the Web Crypto implementation of the host runtime; report those upstream.

• Zero required runtime dependencies. The attack surface from transitive dependencies is eliminated. Every @takk sibling is an optional peer dependency you install explicitly.
• Node-free core. The core, including the audit seal, uses the Web Crypto API (globalThis.crypto.subtle) rather than node:crypto. Only the optional @takk/bayesoutputgate/node loaders touch the Node standard library, and they only read the history file you point them at.
• Provenance. Every release is published with npm publish --provenance (SLSA attestation by GitHub Actions). Verify with npm view @takk/bayesoutputgate@<version> --json | jq .dist.attestations.
• Lockfile committed. pnpm-lock.yaml is tracked in git for reproducible installs.