Detonate executes untrusted MCP servers and skill scripts. A vulnerability in its isolation, acquisition, evidence, or reporting path can therefore have a higher impact than a normal CLI defect.

Before the first stable release, security fixes are made only on the default branch and the newest published prerelease. Older prereleases are unsupported.

Use GitHub's private vulnerability reporting for this repository:

1. Open the repository's Security tab.
2. Choose Report a vulnerability.
3. Include the affected commit or version, host operating system, Docker version, target type, reproduction steps, and expected impact.

Do not open a public issue for an unpatched sandbox escape, host-code execution, credential exposure, report forgery, or release-supply-chain vulnerability. Do not attach real credentials or other people's private targets. A minimized fixture is strongly preferred.

If private vulnerability reporting is unavailable, open a public issue that contains no exploit details and asks the maintainer to establish a private channel.

The project aims to acknowledge a report within three business days, provide an initial assessment within seven business days, and coordinate disclosure after a fix is available. These are targets, not a service-level agreement.

The current security guarantees and known gaps are documented in the architecture, the target architecture, and compatibility notes. In particular:

• Docker is the required isolation boundary whenever Detonate executes an MCP server or a skill's bundled script. Prompt, static MCP, and skill-instruction analysis do not execute target code and do not require Docker.
• Dependency acquisition has two separate phases. The fetch phase has network access but disables package lifecycle/build scripts. Target-controlled install and build hooks run only in the second phase, with network disabled and as a non-root user. Unsupported dependency shapes are refused with acquisition_unsupported; Detonate does not relax this boundary.
• Sandbox runtime images are referenced by multi-platform manifest digest, and saved bundles record the image and source revision used for the scan.
• A no-findings result is not proof of safety; completeness must be inspected.