# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.1.x   | :white_check_mark: |

## Reporting a Vulnerability

We take security seriously at CLDPM. If you discover a security vulnerability, please report it responsibly.

### How to Report

1. **Do not** open a public GitHub issue for security vulnerabilities
2. Email security concerns to: **security@transilience.ai**
3. Include the following information:
   - Description of the vulnerability
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if any)

### What to Expect

- **Acknowledgment**: Within 48 hours of your report
- **Initial Assessment**: Within 5 business days
- **Resolution Timeline**: Depends on severity
  - Critical: 24-48 hours
  - High: 7 days
  - Medium: 30 days
  - Low: 90 days

### Security Best Practices

When using CLDPM, follow these security guidelines:

#### 1. Symlink Security

CLDPM uses symlinks to share components. Be aware that:

- Symlinks can point to sensitive files if misconfigured
- Always verify symlink targets before trusting content
- Use `cldpm sync` to regenerate symlinks from trusted sources

#### 2. Remote Repository Access

When using `cldpm get --remote`:

- Only fetch from trusted repositories
- Set `GITHUB_TOKEN` or `GH_TOKEN` securely
- Never commit tokens to version control
- Use environment variables or secure credential storage

```bash
# Good: Use environment variable
export GITHUB_TOKEN="your-token"
cldpm get project -r owner/repo

# Bad: Token in command history
cldpm get project -r owner/repo --token "your-token"  # DON'T DO THIS
```

#### 3. Component Security

Shared components (skills, agents, hooks, rules) are code that will be executed:

- Review all shared components before use
- Implement code review for shared component changes
- Use branch protection on your mono repo
- Audit component dependencies

#### 4. File Permissions

Ensure proper file permissions:

```bash
# Recommended permissions
chmod 755 shared/          # Directories
chmod 644 shared/**/*.md   # Markdown files
chmod 644 shared/**/*.json # Config files
chmod 755 shared/hooks/**/*.py  # Executable hooks
```

#### 5. Git Security

When using CLDPM with Git:

- Add `.env` and credential files to `.gitignore`
- Never commit sensitive data to shared components
- Use `.gitignore` patterns generated by CLDPM

### Known Security Considerations

| Area | Consideration | Mitigation |
|------|--------------|------------|
| Symlinks | Can traverse directories | CLDPM validates symlink targets |
| Remote fetch | Network exposure | Use HTTPS, verify repos |
| Hooks | Execute arbitrary code | Review all hook code |
| Dependencies | Transitive trust | Audit dependency chains |

### Security Features

CLDPM includes these security features:

1. **Per-directory .gitignore**: Only symlinks are ignored, not entire directories
2. **Path validation**: Prevents directory traversal attacks
3. **No credential storage**: Tokens must be provided via environment

### Acknowledgments

We thank the following individuals for responsibly disclosing security issues:

*No vulnerabilities have been reported yet.*

---

<p align="center">
  Maintained by <a href="https://transilience.ai">Transilience.ai</a>
</p>
