License: Proprietary / source-available (see LICENSE and ADR-0009).
The source is publicly visible; unauthorized commercial use, redistribution, or derivative commercial products are not permitted without a separate written license from the copyright holder.
Please do NOT create public GitHub issues for security vulnerabilities.
Instead, report security issues privately via one of the following channels:
-
GitHub Security Advisories (preferred)
→ https://github.com/maatini/merle/security/advisories/new -
Direct email to maintainers
martin.richardt@maatini.space
(PGP key available on request)
We appreciate responsible disclosure. Please allow reasonable time for remediation before any public discussion of the issue.
| Version | Supported |
|---|---|
| 0.6.x | ✅ Current |
| < 0.6 | ❌ No longer supported |
Configured in .github/workflows/ci.yml:
| Tool | Role | CI severity |
|---|---|---|
| Bandit (SAST, medium+) | Python static analysis on merle-core + tools/merle |
HARD — fails the Security job |
| Trivy (fs, CRITICAL+HIGH) | Dependency / IaC vulnerability scan | HARD — exit-code: "1"; ignore-unfixed: true (only fixed CVEs fail) |
| TruffleHog | Secret scanning (event-aware PR/push diff) | HARD — action built-in --fail; pinned v3.95.9 |
| Ruff / mypy / pytest / merle validate | Quality gates | HARD (Quality job) |
| pre-commit | Hook suite + formatters | HARD |
| Dependabot | Dependency update PRs | Advisory / PR-based |
Unfixed Trivy findings are ignored (ignore-unfixed: true) so only remediatable CRITICAL/HIGH CVEs fail CI.
This policy covers:
merle-core(packages/merle-core/src/merle_core)- Official Copier bot template (
templates/bot/) merleCLI (tools/merle/).opencode/agent, skills, and commands- CI/CD workflows, Dockerfiles, Devbox configuration
- Documentation that could leak secrets patterns or credentials guidance
- Issues in the rpa-opencode-hybrid/ directory → report in the upstream OpenCode project or the
maatini/merle-opencode-hybridfork (if it exists). - UiPath Orchestrator / Robot / Document Understanding vulnerabilities → follow UiPath responsible disclosure process.
- Third-party dependencies (report via their respective channels; we track critical ones via Dependabot / Trivy).
- Critical (remote code execution, secret leakage, supply-chain in template): 24–48h initial response
- High: 5 business days
- Medium/Low: Next planning cycle
We appreciate responsible disclosure. Reporters may be credited in release notes or a security changelog unless they prefer anonymity.
Last updated: 2026-07-25
Maintained by: Merle RPA Platform Team
Related: ADR-0009 (public source-available visibility)