# Security Policy

## Supported Versions

| Version | Supported |
|---|---|
| 1.0.x | yes |
| < 1.0 | no |

## Trust Model

Imhotep is a test framework. It runs with the privileges of the invoking test process.

Primary trust boundaries:

1. Node test process (full local process privileges)
2. Playwright browser context (page JavaScript execution)
3. CDP extraction channel (local browser debugging protocol)

## Execution Safety Posture

- No dynamic `eval`/`new Function` based execution for assertions.
- Assertions are compiled to structured representations (AST/IR/FOL), then evaluated.
- Runtime extraction diagnostics fail closed instead of silently passing unsupported cases.

## CDP Constraints

- CDP usage is intended for local Playwright sessions.
- Extraction is read-oriented (DOM/CSS/layout facts) with temporary correlation attributes removed after use.
- No built-in remote debugger dialing behavior is provided by framework defaults.

## User-Supplied Code Risks

The following run as trusted code and must be treated accordingly:

- custom renderer adapters
- custom predicates/evaluators
- fixture pages loaded in browser contexts

Do not run untrusted fixtures, renderers, or test helpers in privileged environments.

## Data Sensitivity

Imhotep outputs may include selectors, text labels, geometry, and diagnostics.

- Treat logs/artifacts as potentially sensitive in CI.
- Redact or avoid committing environment-specific secrets captured by test harness code.

## Vulnerability Reporting

Open a GitHub issue labeled `security` for non-sensitive reports.

If disclosure should be private first, include "PRIVATE SECURITY REPORT" in the issue title and avoid posting exploit details until maintainers respond.