# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in Airut, please email
**security@airut.org** instead of opening a public issue.

Please wait for a fix before publishing details.

## Scope

Before reporting, review the [Security Model](doc/security.md) to understand
Airut's security boundaries. Consider whether your finding undermines the
documented guarantees (email authentication, container isolation, network
sandbox, credential protection) or falls outside them (e.g., prompt injection
within the sandbox, actions within allowlisted scope).

## Response

Airut is an experimental project developed between other commitments. We will
address reports on a best-effort basis but cannot guarantee specific timelines.
