# Security Policy

## Supported Versions

The latest `0.1.x` release receives security fixes. Older prerelease builds may be asked to upgrade before a report can be reproduced.

## Report a Vulnerability

Use [GitHub's private vulnerability report](https://github.com/Anionex/dsh-pinned-sessions/security/advisories/new). Include:

- the plugin and DeepSeek Harness versions;
- the affected `web` or `desktop` profile;
- reproduction steps and impact;
- logs or a minimal proof of concept with tokens, conversation content, local paths, and personal data removed.

Do not open a public issue for an undisclosed vulnerability. The maintainer will acknowledge a report after reviewing enough information to reproduce it. Disclosure timing depends on severity, fix availability, and coordination with affected DSH components.

## Scope

Reports about this plugin's Session identity capture, local pin storage, DOM integration, or service calls belong here. Vulnerabilities in DeepSeek Harness itself should also be reported to its maintainers through their published security channel.