We take security vulnerabilities seriously. If you discover a security issue, please report it responsibly.

1. Do NOT create a public GitHub issue for security vulnerabilities
2. Use GitHub Security Advisories to report privately
3. Include as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

• Acknowledgement: Within 48 hours of your report
• Initial Assessment: Within 7 days
• Resolution Timeline: Depends on severity
  • Critical: 7 days
  • High: 14 days
  • Medium: 30 days
  • Low: 90 days

• We follow coordinated disclosure
• We will credit reporters in release notes (unless anonymity is requested)
• We request 90 days before public disclosure to allow time for a fix

This project implements multiple layers of security:

• Pre-commit: Secret scanning with secretlint
• Push protection: GitHub Secret Scanning
• SAST: GitHub CodeQL analysis
• Dependencies: Dependabot alerts and updates
• CI: Vulnerability scanning in pull requests

The following are in scope for security reports:

• The claude-auto-resume CLI tool
• Build and release pipelines
• Documentation website

The following are out of scope:

• Third-party dependencies (report to maintainers directly)
• Social engineering attacks
• Denial of service attacks