中文版本见下方 安全策略（中文）

Security updates are provided for the current minor release series and the previous one.

We take security issues seriously. If you discover a vulnerability in Clarity, please report it responsibly.

Preferred channel: Open a GitHub Security Advisory (private, visible only to maintainers).

Alternative: Email juice094@users.noreply.github.com with the subject [Clarity Security] <brief description>. Please include:

• Affected version(s) and commit hash if known
• Steps to reproduce
• Potential impact assessment
• Suggested fix (if any)

We follow coordinated vulnerability disclosure. We will not take legal action against researchers who act in good faith.

Clarity is designed with the following security-first constraints:

1. Local-first execution: The core agent engine runs entirely on your machine. No remote telemetry, no cloud dependency for basic operation.
2. No forced data exfiltration: User data (sessions, memory, API keys) never leaves the local system unless the user explicitly configures an external provider or channel.
3. API Key hygiene: Clarity supports ${env:VAR} syntax for API keys to avoid plaintext storage on disk. We strongly recommend using this over hardcoded keys in config files.
4. Tool sandboxing: File-system tools enforce path resolution with base-directory containment (resolve_path). Parent-directory traversal (../) and deep symlinks are rejected by default.
5. Approval gating: High-risk tools (shell, file_write) require explicit user approval in Interactive and Plan modes. YOLO mode can be enabled only via explicit opt-in.
6. Snapshot isolation: The side-Git snapshot feature (Sprint 38-C+) uses a separate bare repository (~/.clarity/snapshots/) to avoid polluting or exposing the user's main project history.

• cargo audit is run regularly to track RUSTSEC advisories.
• Unmaintained dependencies are tracked in Cargo.toml comments and resolved on a rolling basis.
• Binary releases are built via GitHub Actions with reproducible workflow definitions (.github/workflows/).

# Example: harden a Clarity agent profile
[agent]
approval_mode = "interactive"   # Never run YOLO on sensitive projects
read_only = false               # Set true for audit/dry-run scenarios
max_iterations = 20             # Limit unbounded agent loops
extract_memories = true         # Persist learnings locally (never remote)

[snapshot]
enabled = true
max_snapshots = 10              # Limit side-repo growth

安全更新仅提供给当前 minor 版本及其前一个 minor 版本。

首选渠道：GitHub Security Advisory（私密，仅维护者可见）。

备用渠道：发送邮件至 juice094@users.noreply.github.com，主题格式 [Clarity Security] <简述>。请包含：

• 受影响版本及 commit hash（如已知）
• 复现步骤
• 潜在影响评估
• 建议修复方案（如有）

我们遵循协调式漏洞披露原则。对于善意研究者，我们不会采取法律行动。

1. 本地优先执行：核心 Agent 引擎完全在本地运行，无远程遥测，基本操作不依赖云端。
2. 禁止强制数据外泄：用户数据（会话、记忆、API key）不会离开本地系统，除非用户显式配置了外部服务商或通道。
3. API Key 卫生：支持 ${env:VAR} 语法避免明文落盘。强烈建议在配置文件中使用此语法，而非硬编码密钥。
4. 工具沙箱：文件系统工具强制执行基于工作目录的路径解析（resolve_path），默认拒绝父目录穿越（../）和深层符号链接。
5. 审批门控：高风险工具（shell、file_write）在 Interactive 和 Plan 模式下需要用户显式审批。YOLO 模式只能通过显式 opt-in 启用。
6. 快照隔离：Side-Git 快照功能使用独立的 bare 仓库（~/.clarity/snapshots/），避免污染或暴露用户主项目历史。

• 定期运行 cargo audit 跟踪 RUSTSEC 安全公告。
• Cargo.toml 中标记了未维护依赖，按滚动计划解决。
• 二进制发布通过 GitHub Actions 构建，工作流定义可复现（.github/workflows/）。