# Security Policy

## Reporting a vulnerability

Please do NOT open a public issue for security problems.

Contact the maintainer privately via GitHub (**@vclike** — use "Report a
vulnerability" on the Security tab of this repository, or a direct message).
You will get an acknowledgment within 72 hours and a fix timeline within 7
days for confirmed issues.

## Scope notes for this plugin

- **Token handling**: the PAT is resolved through the host credential seam per
  request and never written to logs or subprocess environments. A token saved
  through the settings UI persists server-side in the host's settings document
  (plaintext on disk — documented in README; prefer `credentialRef` env
  resolution if that is a concern).
- **Network surface**: the plugin talks only to the configured REST root
  (default `https://api.github.com`). It runs no servers.
- **The permission gate is an example**, not a hardened boundary: it gates
  tool calls by name in-process. Do not treat it as a sandbox against a
  hostile model.

## Supported versions

Only the latest tagged release receives security fixes.