Safety Guarantees & Responsible Disclosure
ContribLens is engineered with non-negotiable safety boundaries. We verify facts through deterministic code, summarize evidence through grounded AI, and mandate human approval before anything is published.
We never execute untrusted scripts, test runners, or dependency hooks. All analysis is performed through safe, in-memory static AST and manifest parsers.
Detected tokens, API keys, and passwords are masked with asterisks before database writes or AI requests. Public issue drafts are unconditionally blocked for secrets.
Our model adapter is strictly prohibited from inventing CVEs, inflating severities, or discussing ungrounded hypotheses. Every explanation links directly to a deterministic rule finding.
No automatic pull requests or public issue spam. Maintainers review, verify, and publish issue drafts manually. The badge always reads “Maintainer review required”.
Responsible Disclosure & Safety FAQ
Coordinated Vulnerability Disclosure
If you identify a security issue in ContribLens itself or have responsible disclosure inquiries, contact security@contriblens.org. We respond within 48 hours and adhere to coordinated disclosure standards.
© 2026 ContribLens. Safety, privacy, and beginner enablement.