# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability or potential data leakage issue within **OKF Agent Memory**, please do **not** disclose it publicly via GitHub issues or public forums.

Please send a responsible disclosure report with steps to reproduce to:
- **Email**: `security@okf-memory.dev`
- Or submit a private security advisory directly via [GitHub Security Advisories](https://github.com/okf-memory/okf-agent-memory/security/advisories/new).

We will acknowledge receipt within 48 hours and work with you to coordinate a fix before any public announcement.

---

## Security & Data Governance Guidelines

For our complete threat model, PII protection rules, secret prevention policies, and memory poisoning defenses, please consult our normative [Security, Privacy & Data Governance Guidelines](docs/security/SECURITY.md).