Project-Kiln/SECURITY.md

Security policy

Reporting

Do not open a public issue for an unpatched vulnerability, leaked credential, unsafe provider parser, privilege-boundary failure, or command-execution flaw. Until a private security contact is configured for the eventual repository host, retain the report locally and contact the project owner through an already established private channel.

No public security-response address is published during private development. A tested private reporting route and disclosure policy are mandatory before public release.

Supported versions

There are no public supported releases. The private main branch receives security fixes.

Handling rules

• Never attach live provider tokens, personal library dumps, save files, or proprietary launcher state to an issue or fixture.
• Provide the smallest sanitized reproducer that demonstrates the boundary failure.
• Record affected revision, platform, exact command, expected/observed behavior, and whether exploitation requires local access, provider-controlled data, or privilege.
• Rotate any disclosed secret immediately; redaction after publication is not recovery.