Only the latest published version of Tacit receives security fixes. Please reproduce an issue on the latest version before reporting it when practical.

Use GitHub private vulnerability reporting. Do not open a public issue for a suspected vulnerability.

Include the Tacit, DeepSeek Harness and Node versions, the impact, and minimal sanitized reproduction steps. Never include API keys, credentials, private prompts or complete session logs. Privacy failures, unintended model data disclosure, cross-site route access, unsafe filesystem behavior and ways to bypass cost controls are all in scope.

Tacit's intended data flow and current limitations are documented in Privacy, cost and known limitations.