# Security Policy

## Reporting a vulnerability

Please **do not** open a public issue for security problems.

Instead, report privately via GitHub's
[Report a vulnerability](https://github.com/your-username/okf-studio/security/advisories/new)
(Security tab → Advisories), or email **<your-contact-email>**.

We aim to acknowledge reports within a few days and to provide a fix or
mitigation timeline after triage.

## Scope and design notes

OKF Studio is a knowledge-base *producer*. A few security properties are built
into its design — please keep them in mind when reviewing or extending it:

- **Ingested content is untrusted data, not instructions.** The skill must never
  execute instructions embedded in sources (prompt injection). Suspicious
  instructions are surfaced to the user, not obeyed.
- **No secrets in bundles.** Credentials/tokens found in sources must be redacted
  and never written into an OKF bundle. Generated bundles live under `bundles/`
  and are gitignored.
- **Scripts are read-only over your sources** and never connect to production
  systems with write access.
- **`scripts/` are pure standard library.** New dependencies expand the attack
  surface; the bar for adding one is high.

If you find a way to make the skill leak secrets, execute injected instructions,
or write outside the intended output directory, that is a security issue — please
report it privately.

## Supported versions

This project is pre-1.0 / actively developed; security fixes target the latest
`main`.
