Security
How to report a problem, what the library does with your data, and what it does not offer.
Reporting and data
Report a problem
Email licensing@c2consultants.net with "security" in the subject line. The contact is also published in /.well-known/security.txt. Please do not report security problems in public issue trackers or forums.
Intent files are data
No code runs from a file. Code checks and result types must be registered by your application, by name. Values nest at most 64 levels deep, and YAML aliases may not expand a file past 100,000 nodes; a file that breaks a limit is reported, not loaded. A file can choose which of your providers its requests go to: see What is sent.
What is not offered
No security certification. No automatic masking of personal data before it reaches the model: what your application sends is what the model receives.
What leaves your network: the prompt, sent only to the providers you configure
Only your model providers (OpenAI, Anthropic, an IChatClient or a provider of your own) receive your requests. Nothing goes to us, and the library never logs API keys or connection strings. What is sent lists every part of a request, when each part is sent, where it goes and what stays on your machine.
How the key is handled
A license key is a signed record. The library checks its signature and its dates offline, when a client is built, and sends nothing to us. Keep keys out of source control: they are confidential under the license.
What to report, and how
In scope
- The libraries:
IntentSharp,IntentSharp.CatalogandIntentSharp.Extensions.AI. - The license service at license.intentsharp.com: the evaluation form, the checkout and the keys it issues.
- This website, intentsharp.com.
What to include
- What you found and where: the package and version, or the address.
- The steps to reproduce it, and what an attacker could do with it.
- How to reach you for follow-up questions.
Please do not
- Make real or test payments, or send card details, to probe the checkout.
- Submit the evaluation form repeatedly or with other people's addresses: every accepted request sends a real email.
- Access, change or delete data that is not yours, or degrade the service for other people, for example with high-volume automated scanning.
We will acknowledge the report, confirm whether we can reproduce it, and tell you when a fix is released. Please give us reasonable time to release a fix before you disclose the problem publicly.
Advisories: every security fix is listed in the changelog, under Security in the release that contains it, with what it fixes. Which versions receive security fixes is in the support policy.