# Security Policy

CipherNest is an open source AI application security platform. We welcome responsible disclosure for vulnerabilities affecting the VS Code extension, CLI, GitHub Action, GitHub App, MCP Server, MCP Gateway, rule engine, or benchmark.

## Supported Versions

| Version | Supported |
| ------- | --------- |
| v1.0.0-beta | Yes |
| 0.4.x and earlier | Limited |

## Responsible Disclosure

Please report suspected vulnerabilities privately before public disclosure.

- Open a private security advisory on GitHub when available.
- If private advisories are unavailable, contact the maintainer through the repository owner profile.
- Include affected component, reproduction steps, impact, and any proof of concept.

## Response Targets

| Severity | Target response |
| -------- | --------------- |
| Critical | 48 hours |
| High | 5 business days |
| Medium | 10 business days |
| Low | Best effort |

## Scope

In scope:

- Secret exposure or credential leakage
- Unsafe MCP tool execution or gateway bypass
- Prompt injection paths that cause unintended privileged actions
- Scanner bypasses with security impact
- Malicious rule package behavior
- VS Code webview security issues
- CI/CD and GitHub integration vulnerabilities

Out of scope:

- Findings against intentionally vulnerable test fixtures
- Denial-of-service reports without security impact
- Social engineering against maintainers or users
- Vulnerabilities in third-party services not controlled by CipherNest

## Threat Model

The platform threat model is maintained in [docs/threat-model.md](docs/threat-model.md).
