# Security Policy

## Supported version

Version `0.1.0` is the first release candidate. Security fixes after public publication will be shipped as a new version; the published `0.1.0` artifact must not be overwritten.

## Reporting a vulnerability

Report vulnerabilities through GitHub Issues: <https://github.com/firefly0916/learning-session-organizer/issues>. Do not include private learning-session databases, reports, bearer tokens, environment files, or credentials in public issue text.

## Security boundaries

- The package stores learning data locally and does not require npm credentials, GitHub credentials, or remote services at runtime.
- Native Pi tools do not receive or return bearer tokens. Legacy MCP integrations may use bearer credentials supplied by the host; keep those values out of prompts, reports, logs, and issue reports.
- CI and release-check preparation are non-publishing. `git push`, tag creation, npm authentication, `npm publish`, and GitHub Release creation are manual release-operator actions.
- Release package inspection rejects source maps, database files, environment files, credential-shaped material, unsafe paths, and unapproved archive entries.