If you discover a security vulnerability in RAMP-Kit, please report it responsibly:

1. DO NOT create a public GitHub issue
2. Email: synthai@synthai.biz
3. Include:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We aim to respond within 48 hours and will work with you to address the issue.

RAMP-Kit is designed with privacy as a core principle:

• No external data transmission — All processing is local
• No telemetry — We don't collect usage data
• No cloud dependency — Works fully offline
• Local storage only — Decisions stored in ~/.ramp/

All user input is validated before processing:

All output is sanitized before display or export:

• Terminal output — Control characters removed
• Markdown export — Special characters escaped
• JSON export — Schema validated
• RAMP cards — Content sanitized

The CLI checks config file permissions:

# Recommended: 600 (owner read/write only)
chmod 600 ~/.ramp/config.json

If permissions are too open, a warning is displayed.

~/.ramp/
├── config.json     # Settings
├── decisions/      # Decision history
└── cards/          # Custom RAMP cards

When using RAMP in CI/CD pipelines:

1. Don't log sensitive decisions — Use --quiet for security-sensitive checks
2. Validate exit codes — Use --strict for enforcement
3. Audit trail — JSON output can be stored securely
4. No secrets in decisions — Never include credentials in decision text

- name: RAMP Gate Check
  run: |
    ramp gate "${{ github.event.pull_request.title }}" \
      --strict --json > ramp-result.json
  env:
    # No secrets needed - RAMP is local-only

We use:

• npm audit for vulnerability scanning
• Dependabot for automated updates
• Minimal runtime dependencies

To audit your installation:

cd /path/to/ramp-kit
npm audit

1. Protect your config directory

   chmod 700 ~/.ramp
   chmod 600 ~/.ramp/config.json

2. Don't include secrets in decision text

   • Bad: "Deploy API key sk-12345 rotation"
   • Good: "Deploy API key rotation"

3. Review exported decisions before sharing

1. Validate all CLI input — Use validation module
2. Sanitize all output — Use sanitization module
3. No external calls — RAMP is local-only by design
4. Test security — Run npm run test:security

The test suite includes security-specific tests:

npm run test:security

Tests cover:

• Input validation
• Output sanitization
• File path security
• Config permission checks
• Decision ID validation

• Local-first architecture (no external transmission)
• Input validation for all CLI arguments
• Output sanitization for exports
• Config permission warnings
• CI/CD security guidelines

🔒 Security is a feature, not an afterthought.