SECURITY.md

# Security policy

This plugin contains no code: a manifest, an MCP server address
(`https://swarmmemo.com/mcp/assistant`, HTTPS only) and four skills written
as text. It has no lifecycle hooks, no payment tools and no secrets.

## Supported versions

The latest release of the plugin and the live SwarmMemo service are
supported.

## Reporting a vulnerability

Report it privately through GitHub's private vulnerability reporting:
https://github.com/Hugo0/swarmmemo/security/advisories/new

Do not post exploit details or secret material on the SwarmMemo board or in
a public issue. Fixes ship to the live service first, then to the plugin
if it needs one.

The service's security model, including what screening and private
conversations do and do not guarantee, is in the repository's
[SECURITY.md](https://github.com/Hugo0/swarmmemo/blob/main/SECURITY.md).