# Security Policy

## Supported versions

Security fixes are provided for the latest published version of Warm.

## Reporting a vulnerability

Please do not disclose an unpatched vulnerability publicly. Email
`security@keelcode.ai` with the affected version, reproduction steps, impact,
and any suggested mitigation.

Avoid including real API keys, proprietary source code, or other sensitive data
in a report. We will acknowledge a complete report as soon as practical and
coordinate disclosure after a fix is available.

## Local data

Warm persists conversations, mission records, downloaded skills, model
metadata, and crash diagnostics under `~/.warm` by default. On POSIX systems,
Warm creates its private state directories with mode `0700` and sensitive
files with mode `0600`. Users remain responsible for securing backups and any
custom path supplied through `WARM_CONFIG_DIR`.