chore: establish phase 0 baseline

2026-07-18 18:20:34 -04:00
commit b38da7d53f
42 changed files with 2618 additions and 0 deletions
@@ -0,0 +1,25 @@
+# Security policy
+
+## Reporting
+
+Do not open a public issue for an unpatched vulnerability, leaked credential, unsafe
+provider parser, privilege-boundary failure, or command-execution flaw. Until a private
+security contact is configured for the eventual repository host, retain the report
+locally and contact the project owner through an already established private channel.
+
+No public security-response address is published during private development. A tested
+private reporting route and disclosure policy are mandatory before public release.
+
+## Supported versions
+
+There are no public supported releases. The private main branch receives security fixes.
+
+## Handling rules
+
+- Never attach live provider tokens, personal library dumps, save files, or proprietary
+  launcher state to an issue or fixture.
+- Provide the smallest sanitized reproducer that demonstrates the boundary failure.
+- Record affected revision, platform, exact command, expected/observed behavior, and
+  whether exploitation requires local access, provider-controlled data, or privilege.
+- Rotate any disclosed secret immediately; redaction after publication is not recovery.
+