# Security Policy

## Supported Versions

Security fixes are currently provided for the latest `0.1.x` patch release only.

## Reporting A Vulnerability

Do not open public issues, pull requests, or discussions with exploit details for
suspected vulnerabilities.

`pianno` does not currently publish a dedicated public security mailbox or PGP
key in this repository.

Use an existing private maintainer contact for this project. If you do not
already have one, open a minimal public issue that only asks for a private
reporting channel and does not include vulnerability details, secrets, crash
dumps, or reproduction steps.

Private reports should include:

- affected version
- affected deployment shape or configuration
- reproduction steps with secrets redacted
- impact assessment
- affected files, endpoints, or config keys if known
- suggested mitigation if available
- whether any credential exposure is suspected

Current limits:

- triage is best-effort; no response SLA or bug bounty program is currently
  offered
- only the latest `0.1.x` patch release is in scope for security fixes
- reports that require access to your private WeCom tenant, model-provider
  account, or production secrets should be sanitized before sharing

If a WeCom bot secret, provider API key, or other credential may have been
exposed, rotate it immediately. Secret rotation is an operator action and
should not wait for a code fix.

## Secret Handling Baseline

- `config/pianno.example.yml` contains placeholders only and must not be used as
  a production config as-is
- keep real secrets in a local-only config such as `~/.config/pianno/config.yml`
  or inject them at deploy time; do not commit them to the repository
- recommended local permissions are `0700` for `~/.config/pianno` and `0600` for
  `config.yml`
- treat `channels.wecom.accounts.<name>.botSecret` and `agent.env` entries such
  as `OPENAI_API_KEY` as secret material
- pull requests and `main` pushes run automated dependency review and a
  Gitleaks-based secret scan; treat that as a baseline check, not as a
  substitute for review or credential rotation