# Security Policy

## Supported versions

Security fixes are applied to the latest release line. The `main` branch may contain unreleased changes and is not a supported production version.

## Reporting a vulnerability

Please use [GitHub Private Vulnerability Reporting](https://github.com/ShinonomeAya/dsh-git-chain/security/advisories/new) when available. Do not disclose credentials, workspace paths, repository contents, or exploitable request details in a public issue.

If private reporting is unavailable, open a minimal issue asking for a private contact channel and do not include sensitive details.

Please include the affected version, DSH profile, operating system, reproduction steps, and expected versus actual behavior. Do not include secrets or private repository data.

## Security boundaries

The plugin limits Git access to DSH-registered workspaces, validates paths, branches, and commit IDs, uses argument arrays instead of shell strings, and protects branch switching against common destructive states. These controls are defense-in-depth and do not replace normal workspace backups.