Security reports are handled privately and with priority.

Do not open a public GitHub issue for security reports.

Preferred path:

1. Use GitHub private vulnerability reporting for osodevops/chukei when it is available.
2. If that is unavailable, email security@oso.sh.
3. If email bounces, use enquiries@oso.sh with the subject prefix [chukei security].

Please include:

• affected version or commit SHA;
• reproduction steps;
• expected impact;
• whether credentials, customer query text, or evidence bundles were exposed;
• any proposed patch or mitigation.

chukei's core production invariants are:

• fail open to Snowflake when chukei cannot make a safe decision;
• never store or log client credentials;
• never cache unsafe or non-deterministic query results;
• treat cache false positives as security bugs;
• keep evidence signatures verifiable and tamper-evident.

Reports that violate those invariants should be treated as security reports, even if they do not expose traditional remote-code-execution or privilege escalation behavior.