# Security Policy

## Supported versions

Security fixes are provided for the latest published version of Keelcode.

## Reporting a vulnerability

Please do not disclose an unpatched vulnerability publicly. Email
`security@keelcode.ai` with the affected version, reproduction steps, impact,
and any suggested mitigation.

Avoid including real API keys, proprietary source code, or other sensitive data
in a report. We will acknowledge a complete report as soon as practical and
coordinate disclosure after a fix is available.

## Local data

Keelcode persists conversations, mission records, downloaded skills, model
metadata, and crash diagnostics under `~/.keelcode` by default. On POSIX systems,
Keelcode creates its private state directories with mode `0700` and sensitive
files with mode `0600`. Users remain responsible for securing backups and any
custom path supplied through `KEELCODE_CONFIG_DIR`.