# Security Policy

## Supported versions

Security fixes are released for the latest `0.1.x` version tested with DSH `0.1.0-rc.6`.

## Report a vulnerability

Please use GitHub's private security advisory flow for `JayDong9130/dsh-evolution-lab`. Do not include credentials, raw DSH sessions, private evaluation fixtures, or unredacted project paths in an issue. Include the plugin/DSH/Node versions, a minimal synthetic reproducer, expected boundary, and observed behavior.

## Security boundary

Evolution Lab may read committed session events, write `.dsh/evolution` and managed `.dsh/skills`, call the configured DSH model, and start evaluator child processes. It must not broaden sandbox/approval policy, emit executable candidates, persist plaintext credentials, leak held-out tasks to the proposer, or activate a candidate without a readable proof.

See [docs/security-model.md](docs/security-model.md) for threats, invariants, recovery and residual risks.