# Security Policy

## Supported Versions

We provide security fixes for the latest minor of the current major. Older versions get fixes only for severity ≥ high.

| Version | Supported              |
| ------- | ---------------------- |
| 15.x    | ✅ active              |
| 14.x    | ⚠️ security fixes only |
| ≤ 13.x  | ❌ end-of-life         |

## Reporting a Vulnerability

**Do not open a public GitHub issue for security reports.**

Please report vulnerabilities privately via GitHub's [Security Advisory](https://github.com/mmerterden/multi-agent-pipeline/security/advisories/new) flow. If GitHub Advisories are unavailable to you, email the package owner (see `package.json` → `author`) with:

- A clear description of the issue and its impact
- Steps to reproduce (a minimal repro is most helpful)
- Affected version(s) and platform
- Optional: a suggested patch or mitigation

You should receive an initial acknowledgement within **5 business days**. We'll keep you updated on progress and aim to release a patch within **30 days** for high/critical issues.

## Scope

This pipeline orchestrates external systems (Jira, Bitbucket, GitHub, Confluence, Figma) using user-supplied tokens. We consider the following in scope for security reports:

- **Token leakage** - any code path that logs, echoes, or persists secrets outside macOS Keychain.
- **Command injection** - bash invocations built from untrusted input (Jira summary, branch names, PR titles, etc.).
- **Pre-commit bypass** - secret-detection hook silently failing or being skippable without `--no-verify`.
- **Pipeline tampering** - agent-state.json or preferences manipulation that escalates an installed package's effective permissions.

Out of scope:

- Misconfigured user systems (broken Keychain, expired tokens, missing CLI tools).
- Vulnerabilities in transitive dependencies that don't reach a code path we use (please report those upstream first).
- Issues that require an attacker to already control the user's local machine.

## Coordinated Disclosure

We follow standard coordinated disclosure: researchers are credited (with permission) in the release notes once a fix is shipped. Public disclosure timelines are agreed with the reporter, defaulting to 90 days from initial report or 30 days after a patch is released - whichever is earlier.