From 619e286fa7e34e6709383a6b288470018d3e3c22 Mon Sep 17 00:00:00 2001 From: Koishore Roy Date: Mon, 8 Jun 2026 01:07:37 +0530 Subject: [PATCH] Add SECURITY.md Add a vulnerability-disclosure policy covering the bundled MCP server, skills, and agents. (plugin already ships CONTRIBUTING.md and CODEOWNERS.) Co-Authored-By: Claude Opus 4.8 (1M context) --- SECURITY.md | 34 ++++++++++++++++++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..1c3e5a2 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,34 @@ +# Security Policy + +This repository packages delego for Claude Code — bundling its **skills**, +**review agents**, and the **MCP server**. Installing the plugin places an MCP +server and tooling into a developer's environment, so we take issues here +seriously. + +## Reporting a vulnerability + +**Please do not open a public issue for security vulnerabilities.** + +Report privately via GitHub's +[private vulnerability reporting](https://github.com/Delego-Dev/plugin/security/advisories/new), +or email **koishore@gmail.com**. Include the affected component (skill, agent, or +the MCP server) and reproduction steps. We aim to acknowledge within 72 hours. + +## In scope + +- The bundled **MCP server** (`delego-mcp`) exposing an operation that authorizes, + approves, or mutates the audit ledger in a way the policy should prevent. +- A **skill or agent** that can be steered into running an unintended command, + leaking the policy or ledger, or weakening the firewall it is meant to manage. +- The plugin / marketplace manifests resolving to unexpected code on install. + +## Out of scope + +- The **authorization and audit guarantees themselves** live in the delego + package — report those upstream at + [delego](https://github.com/Delego-Dev/delego/security). +- Misconfiguration in a user's own policy. + +## Supported versions + +Pre-1.0; only the latest released plugin version receives security fixes.