We take security seriously. This page documents how to report vulnerabilities, what's in scope, our response commitment, and the security posture of the products we ship.
Reporting a vulnerability
Email [email protected] with details. Please include:
- A clear description of the issue and how to reproduce it
- The affected URL, command, or code path
- Your assessment of impact (data exposure, availability, etc.)
- Optional: a proof-of-concept
We respond within 72 hours on business days (Athens, Greece time). For high-severity issues we'll engage immediately on receipt.
Safe-harbour commitment
We will not pursue legal action against good-faith security research that:
- Avoids accessing, modifying, or destroying customer data
- Doesn't degrade service availability for other users
- Stops at proof-of-concept (no exfiltration, no ransom, no public disclosure before fix)
- Gives us a reasonable window to remediate (default 90 days; extendable on request)
In scope
roam-code.comand all sub-paths/sub-domains we control- The
roam-codePython package on PyPI and any binary releases - The
Cranot/roam-codeGitHub repository (source + workflows) - The MCP server (
roam mcp) and its tool surface - Anything reachable from
https://cranot.github.io/roam-code/
Out of scope
- Findings on third-party services (Cloudflare, GitHub, PyPI) — please report to those vendors directly
- Self-hosted installations of customer code that include Roam — those are the customer's responsibility
- Non-security bugs (e.g. UI glitches, broken links) — open a regular GitHub issue instead
Hall of thanks
We acknowledge security researchers who report responsibly. Once we have a name to credit, it goes here. Send us how you'd like to be credited (full name, handle, or anonymous).
No reports yet — be the first.
Security posture
The CLI runs locally
The roam-code open-source CLI runs entirely on your
machine. It writes a SQLite file in your repo's .roam/
directory. No network calls. No telemetry. No phone-home.
Audit the source on
GitHub.
Supply-chain integrity
- PyPI releases use OIDC Trusted Publishing (no long-lived API tokens) — see
.github/workflows/publish.yml - Each release is built reproducibly from a tagged commit
- Sigstore attestations are produced by the publish workflow (verifiable provenance)
- The repo enables Dependabot security updates + secret scanning + push-protection
Audit-trail evidence
Roam itself emits in-toto v1 attestations and a SHA-256-chained
audit-trail JSONL on every analysis. Run roam cga verify
on a statement to verify its signature with cosign.
Hosted services posture
- roam-code.com — static site on Cloudflare Pages. Strict CSP, HSTS preload, COOP+CORP, Permissions-Policy, X-Frame-Options DENY. No JavaScript except Cloudflare's email-obfuscation helper. No third-party analytics.
- Roam Cloud (when launched) — metrics-only ingestion. Source code is never uploaded.
- Roam Review (when launched) — PR diffs are processed in our cloud or yours (self-host option). Diffs discarded after analysis. Audit-trail metadata retained per the Privacy Policy.
Disclosure timing
We aim to remediate high-severity issues within 30 days, medium within 90 days, low at our next scheduled release. We'll coordinate any public disclosure with the reporter. Default public-disclosure window is 90 days from initial report; we may extend on request when more time is genuinely needed.
PGP / encrypted reports
We're standing up a PGP key for [email protected].
Until it's published here, send unencrypted; or use the
security.txt for the most
current contact info.
Compliance posture
- EU AI Act Article 12 — Roam emits the kind of audit-trail evidence Article 12 requires. Customers run their own conformity assessment; Roam supplies the data.
- GDPR — see Privacy Policy for data-processing details + sub-processors
- SOC 2 / ISO 42001 / ISO 27001 — control mappings shipped with Roam Self-Hosted; standalone certification roadmapped (no current independent attestation)
Questions about this policy? [email protected].