Please report privately, not in a public issue: open a security advisory on this repository. Include what you did, what happened, and what you expected. You should get an acknowledgement within a few days.

There is no published email address for this project, deliberately. GitHub's private advisory flow is the channel.

Pre-1.0. Only the latest release gets fixes.

MinContext is a local command line tool. It has no server, no daemon, no telemetry and no runtime dependencies. Three things about it are still worth understanding before you run somebody else's data through it.

script and exit_code predicates run a command you supply. That is the feature: your oracle may be a parser, a validator or your own test suite. It is also the obvious way to get somebody to run something they did not intend, because a reproducer package contains a predicate.json that came from a stranger.

The rules, enforced in code:

mincontext verify ./somebody-elses-package therefore cannot be tricked into running a command by the package itself.

The API key is read from an environment variable (OPENAI_API_KEY by default, --api-key-env to change it) and is never written to a manifest, a trial record, a reproducer package or an error message. tests/test_providers.py asserts it stays out of the model descriptor.

Nothing else is treated as a secret, and that is the important caveat: a reproducer package contains your prompt. If your system prompt, retrieved documents, tool results or memory hold customer data, credentials or anything else confidential, so does the package, and so does trials.jsonl in the results directory. MinContext does not redact and does not pretend to. Read a package before you share it. There is no scrubbing feature; adding one badly would be worse than not having one, because it would invite trust it could not earn.

--out (default ./reproducer), --results-dir (default ./results), and a cache under ~/.cache/mincontext or %LOCALAPPDATA%\mincontext\cache, overridable with --cache-dir and disableable with --no-cache. The cache holds model responses keyed by a hash of the request, so it holds prompt-derived data too.

• It does not phone home. The only network traffic is the request you configured, to the --base-url you gave it.
• It does not evaluate model responses as code. Responses are matched against a predicate, never executed, and json_path uses json.loads, not eval.
• It does not run with elevated privileges or need any.

• --provider cassette and --provider mock make no network calls at all.
• --max-calls N is a hard stop on spending.
• --dry-run costs a run without making a single call.
• --no-cache leaves nothing on disk outside the results directory.