# Security Policy

## Scope

dsh-suite is an install bundle: it registers plugins and nine agent skills into
a DSH profile. It holds no credentials — provider keys live in the operator's
DSH profile, not here — and it ships no route config, only the wiring that
points skill discovery at the bundled skills.

## Supported versions

Only the latest tag on `main` receives security fixes.

## Reporting a vulnerability

Email the owner via the contact on the GitHub profile (andrepontesmelo) rather
than opening a public issue. Include: affected version/commit, a description of
the issue, and expected vs actual behavior. You will get an acknowledgement
within 7 days and a fix or a documented mitigation for anything confirmed.

## What is NOT a vulnerability

- A bundled skill doing what its `SKILL.md` describes — audit unfamiliar skills
  before installing a bundle you did not write.
- An install pulling the declared `dependencies` (`dsh-model-router`,
  `deep-horizon`) — that is the bundle's stated purpose. Pin the install (tag)
  rather than floating on a branch.