AxiomGuard is pre-1.0. The latest stable minor version is the primary supported release line. Beta and other prerelease versions are evaluation builds and may change security defaults or APIs before stable. Security-relevant default changes are announced in UPGRADING.md.

Do not open a public issue for a vulnerability that exposes credentials, private data, or a working exploit against downstream users. Use GitHub's private vulnerability reporting feature for this repository when enabled. If private reporting is unavailable, contact the repository maintainers through their GitHub profiles without posting exploit details publicly.

AxiomGuard provides application-level guardrails. It does not replace:

• network egress filtering or sandboxing;
• a dedicated secrets manager;
• authentication/authorization policy;
• dependency and container vulnerability scanning;
• a full SSRF defense at the socket/proxy layer;
• code review and threat modeling.

assertSafeResolvedUrl performs DNS lookup at validation time and rejects blocked addresses. DNS answers can change after validation. safeFetch re-validates every redirect and bounds time and size, but callers must still enforce network-level egress restrictions for sensitive services.

Webhook HMAC verification must use the exact raw request body. Parsing and reserializing JSON before verification can change bytes and invalidate the security property.

The CLI is intentionally conservative and will not detect every possible secret. It reports only locations and rule names to reduce accidental secret exposure in CI logs.