Security
Understand native-check containment, explicit source-writing permissions, local state, transaction race limits and private vulnerability reporting.
Report a vulnerability privately
Section titled “Report a vulnerability privately”Do not post exploit details in a public issue. Use GitHub Security Advisories for private reporting to the Signalint project.
Native check arguments are untrusted
Section titled “Native check arguments are untrusted”An authorized coding agent can be prompt-injected by repository content or another tool. The native check path validates strict argument objects and resolves selected paths before starting engines:
- Unknown keys, wrong types and invalid detail-reference combinations are refused.
- Path arrays and expanded project snapshots are limited to 512 paths.
- Absolute, NUL-containing, empty, leading-dash, missing and escaping check paths are refused.
- Canonicalization checks containment after symlink/junction resolution.
- Engine processes have bounded output, deadlines, cancellation and best-effort process-tree termination.
These controls do not establish identical permissions or side effects for all 13 tools.
Source-writing permission and 1.2.1 hardening
Section titled “Source-writing permission and 1.2.1 hardening”preview_diagnostic_fix stages caller-supplied full-file replacements in memory. apply_diagnostic_fix writes source and advertises a destructive tool hint. Hosts should require appropriate user permission and show the exact replacement content. confirm: true is a request field, not a human-consent enforcement mechanism.
Preview and apply preflight now both validate containment, including symlink/deepest-existing-ancestor checks. Apply also validates original text/hash. A supplied unknown/expired baseline is refused before writes. These checks improve the boundary but do not lock paths/content against an adversarial external filesystem race or create an OS sandbox.
Writes are sequential adjacent temp-file replacements with an in-memory journal; rollback is best-effort and there is no persistent crash-recovery/fsync contract. Replacement metadata and rename-fallback failure behavior need review. A failed post-check does not revert successful writes. Keep a reviewed version-control diff/backup and verify the full project after applying. Read transaction behavior.
Local execution is not an OS sandbox
Section titled “Local execution is not an OS sandbox”Signalint and its engines run with the launching user’s permissions. Engine-native config can resolve imports, TypeScript extends, plugins and packages using normal filesystem behavior, including outside the project root. Plugins can have their own side effects/network access.
Only execute projects and configurations you trust with your account’s permissions. Signalint is not a SAST scanner, an OS permission boundary, or proof a repository is secure. Tool annotations and a green-looking hook/delta do not substitute for those controls.
State and setup writes
Section titled “State and setup writes”Cache and session data default beneath .signalint/; SIGNALINT_STATE_DIR redirects supported cache/session/project-mode TypeScript paths and can point outside the project. Use absolute, deliberately chosen per-project destinations and protect diagnostic data appropriately.
Normal TypeScript project mode writes partitioned build info; native build mode can use configured destinations elsewhere. init creates missing Signalint configuration, updates .gitignore, and can update selected client settings. Hook installation also writes host config, can replace targeted hook entries, and does not enforce --confirm in non-TTY mode.
Snapshots, LSP buffers and prepared transactions live in server memory. Their retention is bounded; stored snapshots are deep-cloned/frozen and retrieved copies are detached. Content-derived check IDs still are not unique invocation identities. See architecture and hooks.
Stdio, not a hosted service
Section titled “Stdio, not a hosted service”The server uses StdioServerTransport, not an HTTP listener or static file service. It needs no Signalint cloud API or API key. Your MCP client’s forwarding of diagnostics to a model and your plugins’ data handling remain separate trust decisions.
Dependency audit context
Section titled “Dependency audit context”The current source lockfile resolves @hono/node-server@2.1.3 on the SDK dependency path. This is outside the affected <2.0.5 range for GHSA-frvp-7c67-39w9, a Windows static-file middleware advisory. The reviewed stdio server does not instantiate that vulnerable HTTP/static-serving path.
The October 13, 2026 independent production and development lockfile audit runs reported zero known advisories against the pinned upstream lockfile. That result is time- and dependency-scoped; it does not prove the transaction or hook logic is free of correctness/security issues.
Source: pinned security policy, projectPaths.ts, and transactions/manager.ts. Runtime behavior takes precedence when older policy prose omits the new source-writing tools or state override.
Error and diagnostic data are not anonymized
Section titled “Error and diagnostic data are not anonymized”The new engine-failure wire helper strips recognizable path/env/stack patterns, but local stderr logs original details. Other refusal/transaction paths and normal diagnostic/project-root fields can expose paths/content by design. This is not a universal redaction boundary. Your client and engine plugins still control what data reaches a model or remote service.