# Security policy

## Scope

This repository contains a DSH Profile Bundle, one user-preset installer, and one Agent composition. It does not need or store model credentials.

## Reporting

Report vulnerabilities through GitHub private vulnerability reporting when available, or email `2380072439@qq.com` with the subject `[dsh-gpt56-ptc security]`. If neither private channel is available, open a public issue titled **Security contact request** with no vulnerability details and ask a maintainer to establish a private channel. Never place secrets, Provider keys, proprietary prompts, repository contents, logs, or exploit details in a public issue.

Maintainers aim to acknowledge a report within seven calendar days and provide a status update within 30 days. Please avoid public disclosure until a fix is released or a coordinated disclosure date is agreed.

## Supported versions

The latest released version receives security fixes. Experimental and unreleased revisions may change without notice. Compatibility is limited to DSH `0.1.0-rc.8` because the copied Code composition and the authoring/mount service contracts are version-sensitive.

## Security boundaries

The preset and Bundle must not:

- relax DSH sandbox or approval policy;
- read or write Provider credentials;
- route data to an unapproved service;
- bypass model safety controls;
- place cross-session services inside the Agent preset;
- treat prompt instructions as a substitute for Host enforcement;
- replace the Host's `agentPresets` service;
- mutate the readonly preset roots;
- adopt, overwrite, repair, or delete any pre-existing preset;
- treat an ownership marker as authority for a future write or removal;
- delete the custom preset during Bundle disposal or uninstall.

The installer edits only an unpredictable staging preset created by official `copy('code', stagingId, ...)`. Before writing, it proves exact first-user-root path equality, regular directory/file types, and realpath containment. Template files are read before authoring. DSH retains id validation, existing-path refusal, symlink dereferencing, owner-only modes, and partial-copy cleanup.

After staging files match their hashes and `standingKeyFor(stagingId)` succeeds, a second official whole-directory `copy(stagingId, 'gpt56-ptc', ...)` publishes the fixed final id. A concurrent final-id winner is never overwritten. The final id is never automatically removed after publication.

Cleanup is limited to the random staging id and requires its marker to retain the current unpredictable UUID installation token. A staging copy rejection performs no cleanup. An ambiguous containment/ownership state is preserved for manual inspection. A cleanup failure preserves both errors rather than broadening deletion authority.

The provenance marker is informational. Its staging token and baseline hashes support phase checks and diagnosis but never authorize adoption, update, final-id overwrite, or final-id deletion. User edits and package removal are expected to leave the custom preset intact.

The project does not claim protection from another malicious process already running as the same OS user, which can manipulate that user's files directly. Report any containment escape, existing-id overwrite, unauthorized roots mutation, cleanup of a non-token staging id, final-id deletion, credential access, or uninstall-time deletion as a security issue.