Never open a public issue for a vulnerability.
Use the forge's private reporting: on GitHub, the Security tab, then Report a vulnerability. The report is visible only to the maintainers.
Target time to first response: 7 days.
| # | Rule |
|---|---|
| S1 | No secret in the repository — not in clear text, not encoded, not in a test |
| S2 | All external input is hostile until explicitly validated |
| S3 | Least privilege by default, including for CI and for agents |
| S4 | Deny by default in authorisation |
| S5 | Never a homemade cryptographic or authentication mechanism |
Operational detail: skeleton/playbooks/security.md.
A secret exposed, even briefly, even in a commit since rewritten: rotate it immediately. Removing it from history is not enough. That is an incident, not a fix.
Changing permissions, accessing secrets, exposing a new service, an irreversible
migration: never a silent execution. The risk named, the impact described, a safe
procedure and a rollback proposed, explicit confirmation asked for
(skeleton/AGENTS.md §5).