# Security Policy

## Supported Versions

| Version | Supported |
| ------- | --------- |
| 0.1.x   | ✅ |

## Reporting a Vulnerability

If you discover a security vulnerability in DeepJIT, please report it responsibly.

### How to Report

1. **Do NOT** open a public GitHub issue for security vulnerabilities
2. Email the maintainers directly or use GitHub's private vulnerability reporting
3. Include:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if available)

### GitHub Private Vulnerability Reporting

Go to the repository's Security tab and click "Report a vulnerability" to submit a private report.

### What to Expect

- We will acknowledge your report within 48 hours
- We will investigate and provide an initial assessment within 7 days
- We will keep you informed of the fix timeline

## Security Notes

- **API keys**: DeepJIT never stores or reads provider credentials itself. Keys are
  resolved by the harness's credential service or the launching environment
  (`DEEPSEEK_API_KEY` etc.). Never commit keys to this repository or any config file.
- **Traces**: execution traces are stored locally in `~/.dsh/deepjit/deepjit.db`.
  Tool results may contain sensitive content; keep the database file permissions
  restricted (the plugin does not set world-readable modes).
- **Self-execution**: flow templates never run `deepjit_*` tools, and every flow step
  passes through the harness permission system (`tools/pre-execute`).