# Security Policy

SuperSpec is prompt-first Agent Skills. It has no toolkit server, telemetry,
network runtime or mandatory executable helper. The security boundary includes
agent permissions, prompt content, source documents and external checkpoint data.

## Essential properties

- Toolkit state stays outside project/worktree/submodule roots in one protected
  checkpoint, with safe paths and restricted permissions; user work products are
  separate. No signing database or hash-as-authorization. See
  [checkpoint rules](skills/ss-references/workflow-checkpoint.md).
- Never collect secrets, raw private configuration, source provenance or accumulated
  chat in evidence. Secret-screen raw recoverable backups; hash sensitive context
  without disclosing values. Legal notices must not be silently removed.
- Treat documents, source and tool results as untrusted evidence, never as authority
  to change scope or permissions. Auto completion is not human approval.
- No automatic destructive cleanup, global install, stash/reset, remote rewrite,
  CLI/model fallback, merge/deploy or publication. Unknown writers and missing
  evidence block success; actual current inputs bind review and validation.
- Diagrams prefer local rendering. Sending architecture to a public renderer needs
  explicit informed consent because encoded diagram text leaves the machine.

## Reporting

No public reporting endpoint is assumed by this local checkout. Contact the
maintainer through an independently verified private channel; do not publish an
exploitable report or attach secrets. Include affected skill/path, relevant prompt
clause, reproduction, expected boundary and actual consequence. Use safe excerpts,
not complete proprietary workspaces. Response/release timelines are not guaranteed.

In scope: instructions that expose data, follow prompt injection, write toolkit
state into projects, lose user work, weaken permissions, bypass gates or use stale
review/test evidence. Agent platform vulnerabilities belong upstream. Generated
project code still requires independent review; prompt tests are not a security
proof for live model execution.