{"protocol":"clank-doc/1","frameworkVersion":"0.8.0","slug":"security-policy","title":"Security policy","description":"Security fixes are made for the latest published minor release. A fix may require upgrading when preserving an older contract would leave users exposed.","group":{"id":"project","title":"Project"},"url":"https://docs.clank.run/docs/security-policy","source":"SECURITY.md","headings":["Supported versions","Reporting a vulnerability","Scope","Disclosure"],"tableOfContents":[{"id":"supported-versions","title":"Supported versions","level":2},{"id":"reporting-a-vulnerability","title":"Reporting a vulnerability","level":2},{"id":"scope","title":"Scope","level":2},{"id":"disclosure","title":"Disclosure","level":2}],"markdown":"# Security policy\n\n## Supported versions\n\nSecurity fixes are made for the latest published minor release. A fix may require upgrading when preserving an older contract would leave users exposed.\n\n## Reporting a vulnerability\n\nDo not open a public issue for an undisclosed vulnerability.\n\nUse GitHub's private vulnerability-reporting flow for this repository. Include:\n\n- the affected Clank version and Node version;\n- the smallest reproducible request, artifact, migration, application, or configuration;\n- the security boundary crossed and realistic impact;\n- whether the issue has been exploited or disclosed elsewhere; and\n- any suggested mitigation.\n\nDo not send real credentials, access tokens, session cookies, master keys, customer data, or production databases. Replace sensitive values with a minimal synthetic reproduction.\n\nMaintainers should acknowledge a complete report within three business days, establish an initial severity and response owner within seven days, and coordinate disclosure after a fix or mitigation is available. Those targets are operational goals, not a guarantee or bug-bounty offer.\n\n## Scope\n\nHigh-value boundaries include:\n\n- authentication, session, CSRF, role, ownership, and CLI-token enforcement;\n- path traversal, symlink substitution, static-file access, and artifact extraction;\n- migration validation, backup, restore, release activation, and rollback;\n- secret encryption, key handling, logging, and process/container isolation;\n- SSR/DOM injection, executable URLs, agent action authorization, and confirmation; and\n- cross-project or cross-user data access.\n\nThe trusted process runner is not a public-code sandbox. Reports that only demonstrate that trusted process-mode application code can access its own Unix user's authority are out of scope unless they cross a documented isolation boundary. Docker and stronger isolation still depend on correct host configuration.\n\n## Disclosure\n\nSecurity releases will describe affected versions, impact, mitigation, and upgrade instructions without publishing exploit details that would unnecessarily endanger users. Credit is offered when requested and safe.\n"}