# Security policy

## Supported versions

| Line | Support |
| --- | --- |
| Repository before any release | Documentation, repository configuration and the profile library reports |
| Executable releases | None published |

There is no extension to run yet. Do not install another package on the assumption that it is this project.

## Reporting

Use [GitHub private vulnerability reporting](https://github.com/Yivas/pi-assistant-prefill/security/advisories/new). Include the commit, affected file or setting, a minimal sanitized reproduction, expected and observed behavior, impact and any workaround.

Remove credentials, tokens, personal profiles, prompts, conversation history, private URLs and machine paths. Do not attach complete provider payloads. If the private form is unavailable, open an issue asking for a private contact without revealing the vulnerability or sensitive data.

The maintainer will assess the report and discuss next steps. There is no promised response deadline, bounty, CVE assignment or embargo period.

The future extension's file access, context handling and distribution need verification before a supported release. This policy does not claim that an unimplemented feature has passed a security review.