This repository publishes the @softure-ai/* packages: the folders under foundation/, modules/, themes/ and tools/ (listed in the README). This policy covers those packages and the release machinery that publishes them.

Every package is still in 0.x, where a minor release may change the API. A fix therefore lands on the latest minor line of each package and ships as a new patch release of that line.

The current version of a package is on npm: npm view @softure-ai/<name> version.

The agent skills (@softure-ai/skills) live in SOFTURE/SKILLS and have their own policy there.

Do not open a public issue, pull request or discussion for a vulnerability.

Report it privately through GitHub: open the repository's Security tab and choose Report a vulnerability (direct link). Only the maintainers see the report.

Please include:

• the package and version (@softure-ai/<name>@x.y.z);
• what an attacker can do, and under which configuration;
• steps or a minimal proof of concept to reproduce it;
• any fix or mitigation you have in mind.

Never include real secrets, tokens or personal data in a report; use placeholders.

We keep you updated in the private advisory until it is resolved, and tell you if a report is not accepted and why.

We follow coordinated disclosure. Once a fixed version is on npm, we publish a GitHub security advisory for the affected package (with a CVE when it qualifies), naming the fixed version, and credit the reporter unless they prefer otherwise. Please give us up to 90 days from the report before disclosing it yourself; we publish earlier when the fix is out.

• Every release is built and published from GitHub Actions (release.yml) through npm trusted publishing, with provenance: npm audit signatures verifies a package came from this repository.
• A fix is a patch release of the supported line; the advisory names the version to upgrade to.

• Dependabot alerts and security updates are on. Security fixes arrive as one grouped pull request, version updates once a week (.github/dependabot.yml); a green security update is merged and rides the next release.
• Code scanning, Dependabot and secret scanning alerts are turned into issues labelled security every hour (security-alerts.yml), and those issues are worked like any other. The issue is closed automatically when its alert is fixed or dismissed. A secret's value never appears in an issue.
• Private vulnerability reports are never turned into issues: they stay in the private advisory until disclosure.

• Vulnerabilities in an application that uses these packages, unless the package itself causes them.
• Issues in third-party dependencies that already have a public advisory (Dependabot picks those up); a report is still welcome when a package uses a dependency in a way that makes it exploitable.
• Missing hardening with no demonstrated impact, and findings from automated scanners without a working scenario.