Read-only, bounded, and explicit.

No checkout mutation

• No project, props, lock, or assets file in the checkout is rewritten.
• No automatic package update or vulnerability remediation is applied.
• simulate changes one validated version value only inside an owned disposable snapshot.
• clean requires --dry-run and produces a review plan only.
• Reports are written only when an explicit output path is supplied.
• No telemetry is collected.

Know when the network may be used

doctor runs dotnet restore by default, and restore can contact feeds from the active NuGet configuration. --audit and--deprecated delegate to separate official SDK/NuGet commands and can contact configured sources. diff gives baseline and current independent package, HTTP, plugin, CLI-home, and temporary caches. simulate performs two independent restores and any requested audits. PackageMedic implements no advisory HTTP client of its own.

# Analyze existing assets without restore or advisory requests
package-medic doctor ./MySolution.sln --no-restore

# Explicitly request official NuGet vulnerability evidence
package-medic audit ./MySolution.sln --include-transitive

# Explicitly request official NuGet deprecation evidence
package-medic doctor ./MySolution.sln --deprecated --include-transitive

Subprocess and output controls

• Restore, audit, and MSBuild processes run with bounded parallelism.
• Restore and evaluation timeouts are configurable and terminate the process tree.
• Captured subprocess output has hard bounds.
• Credential-shaped output is redacted and unsafe terminal controls are removed.
• Executable paths and parent links are canonicalized against logical and physical repository roots.
• Simulation child processes receive isolated NuGet, .NET CLI, home, app-data, and temporary directories.
• Private-feed variables are inherited only when explicitly named with --credential-env.
• Progress stays on standard error so machine-readable standard output remains valid.

Filesystem and Git snapshot controls

• Discovery performs one bounded pass and does not follow nested symbolic links or junctions.
• Explicit targets and solution projects must stay inside the analysis root.
• Missing or inaccessible projects produce operational errors instead of a partial clean scan.
• Git archive paths are canonicalized; traversal, platform ambiguity, and unsafe links are rejected.
• Archives enforce entry, file, expanded-size, free-space, and extraction-time limits.
• Time Machine uses two snapshots of the same commit, validates source SHA-256, and rechecks the worktree after cleanup.

Memory-intensive inputs are bounded

PackageMedic's own supply chain

The repository commits NuGet content-hash lockfiles and restores them in locked mode. The site pins exact direct npm versions, verifies registry HTTPS sources and SHA-512 integrity, installs with lifecycle scripts disabled in CI, audits known vulnerabilities and registry signatures, and pins third-party GitHub Actions to immutable commits.

Enforce trust without hiding uncertainty

In diff, the Impact Gate can restrict changed packages to credential-free HTTPS sources, reject source changes, require effective repository Package Source Mapping for multi-feed projects, and require a valid in-repository lock file with locked restore. Provenance comes from bounded NuGet restore metadata; an active allowlist treats missing source evidence as a violation instead of assuming the package is trusted. A changed SHA-512 hash under the same package ID/version identity is also blocked by default with PMI010. Losing previously observed source or hash evidence is treated as a change, not as an unchanged package.

Snapshot isolation is not an OS sandbox

Time Machine isolates filesystem and cache state, preserves declaration bytes outside the selected version, refuses ambiguous edits, and never relaxes locked restore. Restore and MSBuild can still execute repository-controlled logic with the caller's host permissions and contact configured feeds.

PackageMedic 0.6 can additionally execute builds and tests in both immutable snapshots. That increases the amount of repository-controlled code that runs; it does not add an OS sandbox or container boundary. Review the Verified experiments security model before enabling it, especially on persistent self-hosted runners.