Skip to content

Add SECURITY.md #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
koishore merged 1 commit into from
Jun 7, 2026
Merged

Add SECURITY.md #1

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
34 changes: 34 additions & 0 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,34 @@
# Security Policy

This repository packages delego for Claude Code — bundling its **skills**,
**review agents**, and the **MCP server**. Installing the plugin places an MCP
server and tooling into a developer's environment, so we take issues here
seriously.

## Reporting a vulnerability

**Please do not open a public issue for security vulnerabilities.**

Report privately via GitHub's
[private vulnerability reporting](https://github.com/Delego-Dev/plugin/security/advisories/new),
or email **koishore@gmail.com**. Include the affected component (skill, agent, or
the MCP server) and reproduction steps. We aim to acknowledge within 72 hours.

## In scope

- The bundled **MCP server** (`delego-mcp`) exposing an operation that authorizes,
approves, or mutates the audit ledger in a way the policy should prevent.
- A **skill or agent** that can be steered into running an unintended command,
leaking the policy or ledger, or weakening the firewall it is meant to manage.
- The plugin / marketplace manifests resolving to unexpected code on install.

## Out of scope

- The **authorization and audit guarantees themselves** live in the delego
package — report those upstream at
[delego](https://github.com/Delego-Dev/delego/security).
- Misconfiguration in a user's own policy.

## Supported versions

Pre-1.0; only the latest released plugin version receives security fixes.
Loading