Security and privacy
Report a suspected Bearing Lite vulnerability through the repository’s private vulnerability reporting process, not a public issue, discussion, pull request, or social-media post. Include the affected version or commit, installation method, agent client, minimal reproduction, observed impact, and mitigations if known.
Keep reports safe to share
Section titled “Keep reports safe to share”Use synthetic data where possible. Do not include credentials, customer data, private repository contents, raw agent-session history, or unredacted evidence. If a secret may have been exposed, revoke or rotate it before reporting and include only a redacted identifier.
What deserves careful review
Section titled “What deserves careful review”Report behavior that expands authority, skips required assurance, misrepresents hook enforcement, traverses paths unsafely, mutates the wrong repository boundary, leaks sensitive diagnostics, weakens release integrity, or introduces provider or credential handling into the public product surface.
Bearing Lite is provider-neutral and does not ship credentials or secret lookup paths. A weakness in an agent client or provider normally belongs with that project; report it to Bearing Lite when this package exposes, amplifies, or incorrectly handles the weakness.
Trust boundaries in ordinary work
Section titled “Trust boundaries in ordinary work”Bearing Lite is a local, skills-first package: it has no CLI binary, MCP server, hosted service, telemetry surface, postinstall script, or runtime dependency on another product’s state. It does not select providers, models, credentials, or launchers; owners and compatible clients map roles to available capabilities.
Approved execution stays inside an exact write set and validation set. Planning and implementation are distinct, and a discovered scope or security change returns to the owner rather than silently expanding files or configuration. The only persistent user configuration is the named profile catalog, written by onboarding after explicit choices.
Optional review coverage assist describes which files are reviewable and which are excluded; it finds no defects and produces no verdict. Optional Reverify is an external backend: Bearing Lite does not bundle, download, install, or invoke it. Its verification bridge only shapes a request and receipt supplied by a caller, and unavailable, stale, derived, or inconclusive evidence cannot pass an assurance gate.