SECURITY.md

# Security policy

## Supported version

Only the latest released `0.1.x` version will be supported after public
release. The current tree is a pre-publication candidate.

## Reporting

After the clean public repository is created, use GitHub private vulnerability
reporting for security-sensitive findings. Do not place exploit details,
private memory content, credentials, personal data, or proprietary bundles in a
public issue.

For ordinary defects, create a minimal reproduction using synthetic data. The
publisher cannot accept private vaults or complete conversation archives for
debugging.

## Boundary

This verifier is a data-conformance check, not a runtime authorization control.
The host must independently enforce live approval, sandboxing, and tool policy.