Security Policy

Supported Versions

NgAutoPilot is a documentation and skill catalog repository. Security guidance applies to:

• workflow files
• scripts
• published catalog bundles
• adapter templates
• skill metadata and content

Reporting A Vulnerability

Do not open a public issue for a security-sensitive report.

Use one of these channels instead:

• GitHub Security Advisory, if enabled for the repository
• a private maintainer contact path
• a private repository message if available in your GitHub setup

Include:

• affected file or workflow
• risk description
• reproduction steps, if safe to share
• suggested fix, if known

What Counts As A Security Issue

Examples include:

• shell execution in skills or workflows that can be abused
• untrusted file copying in publish scripts
• credential leakage in actions
• unsafe defaults in generated bundles
• dependency or supply-chain issues in workflows

Local Review Layer

Sage can be used locally to review agent instructions and publish workflows before they reach a pull request.

Use Sage to inspect:

• skills/**/SKILL.md
• adapters/**
• .github/workflows/**
• scripts/*.mjs

Do not treat Sage as a replacement for reporting a security issue to maintainers.

Response Goal

Reports should be acknowledged, triaged, and resolved with the smallest safe change. If a fix touches workflows or publish automation, validate the change before release.