This repository ships a thin client: it packages your problem, sends it over HTTPS, and prints the reply. It contains no solver, executes no untrusted code, and has zero dependencies — there is no transitive dependency tree to audit. The optimization engine runs on HexStellar's service and is not distributed here.

Email support@hexstellar.com with the subject line SECURITY. Do not open a public issue for a security problem. We aim to acknowledge within 2 business days. Please include the CLI version (hexstellar --version), your platform, and a reproduction.

• Keys never travel in cleartext. The client REFUSES to send a bearer key over plain http:// to a remote host (localhost is exempt for development; HEXSTELLAR_ALLOW_INSECURE_HTTP=1 is an explicit opt-in for trusted internal proxies).
• Keys are stored 0600 (~/.config/hexstellar/config.json), never echoed to any output, and redacted from the optional invocation trace.
• stdout is data, stderr is diagnostics — a secret has no path into machine-parsed output.
• The release path is attested end to end: PyPI Trusted Publishing (OIDC — no long-lived tokens), SLSA build provenance, PEP 740 attestations, and a CI allowlist that refuses to ship any file outside the expected set.

The public sandbox is intentionally anonymous and rate-limited; probing its limits is expected use, not a finding. Server-side findings (api.hexstellar.com) are in scope via the same address — please include the RFC 9457 code and the X-Request-Id of any interesting response.

BRAYON PIESKE — "Security controls should be explicit, testable, and reviewed with every release."