Security
How to report a problem, what the library does with your data, and what it does not offer.
Reporting and data
Report a problem
Email licensing@c2consultants.net with "security" in the subject line. A dedicated security address will follow. The contact is also published in /.well-known/security.txt. Please do not report security problems in public issue trackers or forums.
Intent files are data
No code runs from a file. Code checks and result types must be registered by your application, by name. Values nest at most 64 levels deep, and YAML aliases may not expand a file past 100,000 nodes; a file that breaks a limit is reported, not loaded.
What is not offered
No security certification. No automatic masking of personal data before it reaches the model: what your application sends is what the model receives.
What leaves your network: the prompt, sent only to the providers you configure
Your provider (OpenAI, Anthropic or your own IChatClient) receives:
- Every call: the input, the intent, your instructions and examples, and the result schema.
- A retry: the previous answer and the findings, too.
- A judge, if you turn one on: the intent, the input and the answer, with your output requirement if you set one.
- A log given an embedding provider: the intent text, sent to that provider.
It never phones home, it checks the license key offline, and it never logs API keys or connection strings.
How the key is handled
A license key is a signed record. The library checks its ECDSA signature offline, against public keys built into the library, when a client is built, and sends nothing to us. Keep keys out of source control: they are confidential under the license.
What to report, and how
In scope
- The libraries:
IntentSharp,IntentSharp.CatalogandIntentSharp.Extensions.AI. - The license service at license.intentsharp.com: the evaluation form, the checkout and the keys it issues.
- This website, intentsharp.com.
What to include
- What you found and where: the package and version, or the address.
- The steps to reproduce it, and what an attacker could do with it.
- How to reach you for follow-up questions.
Please do not
- Make real or test payments, or send card details, to probe the checkout.
- Submit the evaluation form repeatedly or with other people's addresses: every accepted request sends a real email.
- Access, change or delete data that is not yours, or degrade the service for other people, for example with high-volume automated scanning.
We will acknowledge the report, confirm whether we can reproduce it, and tell you when a fix is released. Please give us reasonable time to release a fix before you disclose the problem publicly.