# Security Policy

## Supported version

Security fixes are provided for the latest released version.

## Report a vulnerability

Do not open a public issue for a suspected vulnerability. Use GitHub's private vulnerability reporting for this repository and include reproduction steps, impact, and the affected version.

## Security model

- The plugin accepts a fixed template schema and checked-in component catalog, never executable model-supplied UI.
- Actions are declarative. They settle a Tool call but have no direct side-effect authority.
- The host validates session, call, surface, source component, action allowlist, fields, types, size, lifecycle, and exactly-once state.
- RPC defaults to loopback. `trusted-host` is an opt-in deployment fence, not authentication.
- Interaction arguments and values are logged for replay and become model-visible. Do not use this plugin to collect secrets.
- Pending interactions are memory-only and fail closed across host restart.