# Security Overview

## git-lrc Security

This document answers security and procurement questions for git-lrc in concrete terms.

Source: [git-lrc Security](https://raw.githubusercontent.com/HexmosTech/git-lrc/refs/heads/main/SECURITY.md).

## Quick Answers [Permalink for this section](/content/livereview/git-lrc/docs/security/#quick-answers/index.html)

- **Vulnerability reports**: use GitHub private security reporting first; use [shrijith@hexmos.com](mailto:shrijith@hexmos.com) if GitHub reporting is not possible.
- **Response time**: acknowledgement within 2 business days; for internally confirmed findings, triage and remediation work starts within 7 calendar days.
- **Default behavior**: git-lrc runs locally as a CLI.
- **Code leaves the machine** only when you submit a review or run setup/update operations that call remote APIs.
- **Review submission** sends staged diff bundle data to the configured LiveReview API.
- **Local files** include configuration at ~/.lrc.toml and repository-local state under .git/lrc.
- **Security scans**: gitleaks, OSV scanner, govulncheck, and Semgrep run in GitHub Actions.
- **SBOM** is generated and attached to release assets.