# Security policy

Report vulnerabilities privately through GitHub Security Advisories for `firestige/crystra-dsh`. Do not include secrets or production credentials in a public issue.

Only the latest stable release is supported. Release workflows use npm trusted publishing (OIDC) and a repository-scoped GitHub App. Installation and qualification do not read, copy, or persist DSH, Copilot, Codex, or npm login credentials. Studio accepts only loopback downstream origins and exposes read-only Evidence/Evolution operations.