Thank you for helping keep the Specfuse Orchestrator and its downstream consumers secure.

Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests. Public reports give attackers a head start while a fix is being prepared.

Instead, open a private security advisory on this repository. The advisory is visible only to you and the maintainers until a fix is published.

Please include:

• A description of the vulnerability and its potential impact.
• Steps to reproduce it (proof-of-concept welcome).
• Affected files / agents / scripts (e.g., a specific skill, a shell helper, a schema).
• Whether the issue is in scaffolding (this repo's content) or could affect a downstream's coordination state (/features/, /events/, /inbox/, override registry).

We aim to acknowledge reports within 7 days and provide a remediation timeline within 14 days.

In scope:

• Vulnerabilities in the orchestrator's scaffolding: the specfuse pm CLI (init / upgrade), schemas, agent configurations that could lead to prompt injection, escalation bypass, or unauthorized writes outside documented surfaces.
• Documentation that could mislead an operator into an insecure setup (missing never-touch.md boundary, unsafe gh permission scopes, etc.).

Out of scope:

• Issues in downstream private orchestration repos (those are the downstream operator's responsibility).
• Issues in Claude Code itself, the Anthropic API, or upstream tools — please report those to the relevant project.
• Issues in the Specfuse generator or _generated/ content in component repos — those belong to the Specfuse generator project.

After a fix lands, we'll publish an advisory describing the issue and credit the reporter (if desired). Until the fix is public, please keep details private.

• shared/rules/never-touch.md enumerates filesystem paths agents must never read or write (secrets, generated directories, /business/ in product specs, branch protection settings).
• shared/rules/security-boundaries.md documents what agents may and may not exfiltrate or transmit.