Skip to content

docs: add SECURITY.md #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Kodaxadev merged 1 commit into from
May 16, 2026
+47 −0
Merged

docs: add SECURITY.md #6

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
47 changes: 47 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,47 @@
# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 3.x | Yes |
| < 3.0 | No |

## Reporting a Vulnerability

If you discover a security vulnerability in Code-Warden, please report it responsibly.

**Email:** synaptikal@gmail.com

**Please include:**
- Description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Impact assessment (if known)

**What to expect:**
- Acknowledgment within 48 hours
- Assessment and timeline within 7 days
- Fix published as a patch release once confirmed

**Please do not** open a public GitHub issue for security vulnerabilities. Use email so the fix can be prepared before disclosure.

## Scope

Code-Warden is a governance and verification tool, not a security boundary. It is designed to catch accidental mistakes (oversized files, hardcoded credentials, scope drift), not to defend against malicious actors.

**In scope:**
- Secret pattern bypasses (credential patterns that should match but don't)
- File traversal issues in scanners or hooks
- Hook bypass conditions in PreToolUse enforcement
- Installer writing files outside intended directories
- npm package containing unintended files

**Out of scope:**
- Governance rules being ignored by an AI agent (prompt-level, not enforceable)
- Issues in third-party runtimes (Claude Code, Codex, Cursor, etc.)
- Social engineering or phishing

## Supply Chain

Code-Warden has zero runtime dependencies. The npm package contains only first-party code. Every release tarball is inspected with `npm pack --dry-run` before publishing.
Loading