Security
What Genesis does
Section titled “What Genesis does”- It never executes code from a repository it analyzes.
- Its secrets scanner redacts every value it finds. It must never write an unredacted secret to disk or to a report.
- Path handling: scaffolding and analysis write into user-supplied directories, and traversal outside the target root is a vulnerability.
- Telemetry is off by default.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Do not open a public issue. Use the private advisory form on GitHub: Report a vulnerability.
The full policy, supported versions and scope are in SECURITY.md.
Generated scaffolds
Section titled “Generated scaffolds”Projects created by genesis init include secret scanning, SAST, a quality gate, a path traversal guard, a non-root Dockerfile and a strict .gitignore.