Security fixes target the latest release on main.

Do not open a public issue for a credential leak, unsafe installer behavior, or prompt path that could authorize destructive production, fund, key, migration, or infrastructure actions. Use GitHub's private vulnerability reporting for this repository.

Include the affected file, a minimal reproduction, expected safety boundary, and whether any credential or private data was exposed. Never paste a live secret into the report.

CM Workflow is primarily Markdown and local scripts. Its main security boundaries are:

• installers must not silently overwrite unrelated user files;
• workflow prompts must retain human gates for high-risk actions;
• third-party assets must have redistributable licenses;
• examples and Git history must not contain credentials or private data;
• external content is data to evaluate, not executable instruction.
• the optional external-expert channel defaults to explicit activation; AUTO requires a current-invocation opt-in, cannot be inherited from a global router, never selects HANDOFF, and never authorizes local-file transmission;
• external-expert must disclose the canonical absolute path of every individual file and obtain fresh approval before sending its content, reject directories, globs, unresolved symlinks, archives, encoded archives, archive-derived bulk context, credentials, and customer data, and keep external responses advisory until locally verified.
• cross-project logs are local-only metadata mirrors under ~/.cm-workflow/logs/ (or CM_WORKFLOW_LOG_HOME), never telemetry or a replacement for the specs-local log; prompts, model responses, source content, external conversation links, cookies, tokens, keys, and customer data are forbidden;
• on POSIX systems the global log writer enforces owner-only directory and file modes (0700/0600); a global mirror failure must be recorded as an explicit local degradation when a project log is available.
• the writer serializes project/global event mutation with local file locks; lock files contain no prompts, source, model output, credentials, or customer data.

The optional Claude auto-updater is disabled until the user explicitly adds the documented SessionStart hook.