Skip to content

SECURITY.md

Latest commit

 

History

History
46 lines (29 loc) · 1.86 KB

SECURITY.md

File metadata and controls

46 lines (29 loc) · 1.86 KB

Security Policy

Supported Versions

Specorator follows semantic versioning. Security fixes target the latest minor release on main; older minors are not patched.

Version Supported
0.8.x ✅
< 0.8 ❌

Reporting a Vulnerability

Please do not open a public issue for security vulnerabilities.

Report privately via GitHub's Private Vulnerability Reporting:

Include, where possible:

  • Affected version, file path, or workflow
  • Reproduction steps or proof of concept
  • Suspected impact (data exposure, privilege escalation, supply-chain risk, etc.)

We aim to acknowledge reports within 5 working days and to ship a fix or mitigation within 30 days for high-severity issues. Lower-severity findings ride the normal release cadence.

Scope

In scope:

  • Code in this repository (scripts, workflows, plugins, agents, skills, templates).
  • The specorator npm package published from this repository.
  • The Claude Code plugin distributed from the dist/claude-plugin branch.
  • Generated artifacts that ship to consumers (GitHub Pages site under sites/dist/).

Out of scope:

  • Third-party AI tools that read this template (Claude Code, Codex, Cursor, Aider, Copilot, Gemini) — report to the respective vendor.
  • Downstream projects that adopt the template — report to the project maintainer.
  • Theoretical risks in agent-driven workflows that are already documented in docs/agentic-security-review.md and tracked as known limitations.

Disclosure

We coordinate disclosure with the reporter. Once a fix is released, we publish a GitHub Security Advisory crediting the reporter unless they request otherwise.