datapact is an offline data-contract runtime. It parses an untrusted contract (YAML or JSON) and an untrusted CSV dataset, lints the contract, and validates the data against it. It reports structural and value failures as DP-* findings rather than executing anything from the input.

The latest commit on main is the only supported version. Security fixes land on main and ship in the next tagged release. Older tags do not receive backports.

• Offline by design. datapact contains no network code. It never opens a socket, resolves a remote reference from a contract, or checks for updates.
• No telemetry. Nothing about your contracts, your data, your usage, or your machine is collected or transmitted.
• Files never leave the machine. Parsing, linting, and validation run in-process and locally.
• Untrusted input. A contract and a data file are treated as hostile: they are parsed as data only. No tags, expressions, or formulas are evaluated, and no code path interprets a field as a command.
• No code execution from input. YAML is parsed without resolving custom or executable tags, JSON is parsed as JSON, and CSV cells are always text.
• No warehouse connection. There is no connection string, no driver, and no query. datapact cannot read from or write to a database.
• Fail safe. A contract or data file that cannot be parsed produces a DP-PARSE-000 error and exit code 2. Unreadable input is never reported as a clean run.

Report privately through GitHub Security Advisories on the repository:

https://github.com/srivtx/datapact/security/advisories/new

Do not open a public issue for a suspected vulnerability. Include a description, the affected revision, a minimal reproducer (a small contract and CSV where possible), and any suggested fix. Expect an acknowledgement within a few days.

bun install
bunx tsc --noEmit
bun test

This installs the locked dependency set, typechecks in strict mode, and runs the test suite against the example contract and data. In CI the same gate runs on every push and pull request.