# Security policy

## Supported version

Security fixes are applied to the latest published `0.1.x` release while DSH remains in developer preview.

## Trust boundary

Installing a DSH plugin grants code the permissions of the DSH host process. Review the package source, lock the version, and install only into profiles whose filesystem and credentials you are prepared to expose to that process.

This plugin does not edit business source files directly. File changes, shell commands, sandbox decisions, approvals, and cancellation remain owned by DSH native tools. The plugin writes only managed Preset files during an explicit `dsh-ome preset` command and OME completion state during `ome_finish`.

The plugin does not collect telemetry or transmit credentials. OME lifecycle events are stored in the active DSH Session Event Log. Completion records are written by the installed `oh-my-engine` package to the selected project.

## Reporting a vulnerability

Do not include secrets, tokens, private Session logs, or sensitive project files in a public issue. Open a minimal report at:

https://github.com/oh-my-engine/dsh-plugin-oh-my-engine/issues

Include the plugin version, DSH version, operating system, affected profile, and a sanitized reproduction. If the report cannot be safely disclosed publicly, request a private reporting channel without posting exploit details.