SECURITY & TRUST
Last Updated: September 14, 2026Security Contact: security@kadmium.dev
Website: https://www.kadmium.dev
Kadmium develops high-performance developer tools, C++ architectures, and runtime systems engineered with a strict focus on privacy, system stability, and transparent code practices.
1. RESPONSIBLE VULNERABILITY DISCLOSURE
If you discover a potential vulnerability in any Kadmium utility, framework, binary distribution, or web endpoint, we appreciate your help in disclosing it to us responsibly.
Reporting Channel: Send technical details, reproduction steps, and proof-of-concept (PoC) code directly to security@kadmium.dev.
Response Commitment: We aim to acknowledge all security reports within 48 hours and provide regular updates on remediation progress.
Coordination: We ask that you provide reasonable time for us to investigate and patch reported issues prior to public disclosure.
Scope: Reports should include affected binary versions, operating system conditions, and clear steps to reproduce.
2. EXECUTABLE SAFETY & SMARTSCREEN POLICY
Independent Software Distribution: Desktop tools (such as Context Packer and Kadmium Launcher) are distributed as standalone, unpackaged executables. Because we do not currently utilize expensive EV (Extended Validation) code-signing certificates, Windows SmartScreen or antivirus software may occasionally flag newly released binaries as "unknown".
Zero Malicious Software: All distributed binaries are guaranteed 100% free of adware, bloatware, telemetry scrapers, background crypto miners, or hidden secondary payloads.
Binary Verification (SHA-256): To verify file integrity, SHA-256 checksums are published alongside official binary releases so developers can verify their downloads have not been tampered with.
Inspectable Source Code: All shared core systems, C# tools, and C++ framework modules are provided with inspectable source code under paid developer tiers to enable thorough internal security audits.
3. DATA PRIVACY & LOCAL EXECUTION
Offline-First Architecture: Tools like Context Packer operate entirely on your local machine. Your source code, local files, repository structures, and prompt data are never uploaded, analyzed, or stored on external Kadmium servers.
Workstation Path Sanitization: Native routines automatically identify and replace workstation account paths (e.g., C:\Users\Username\...) with [REDACTED] prior to generating prompt outputs, protecting private identity details from leakages in LLM contexts.
Minimal Diagnostics: Any optional crash diagnostic telemetry is strictly anonymized and completely devoid of file contents, tokens, code snippets, or network credentials.
4. DEPENDENCY & SUPPLY CHAIN SECURITY
Audited Dependencies: We minimize external dependencies across all C++ and C# codebases. Any third-party open-source libraries incorporated (such as MessagePack) are strictly vetted and kept up to date to minimize supply-chain risks.
No Unsolicited Network Calls: Our offline utilities execute without background auto-updaters or unexpected external API calls during runtime.
5. SECURITY DISCLOSURE FILE
In compliance with web security standards (RFC 9116), our security contact details and disclosure policies are machine-readable and published at: