DO NOT report security vulnerabilities through public GitHub issues.

Report vulnerabilities via email to: security@goondocks.co

Include in your report:

• Type of vulnerability
• Affected source file(s) and location (tag/branch/commit or URL)
• Steps to reproduce
• Proof-of-concept or exploit code (if possible)
• Impact assessment

1. Acknowledgment within 48 hours
2. Assessment of vulnerability and impact
3. Plan for remediation
4. Regular progress updates
5. Credit for discovery (if desired) upon disclosure

• Never commit secrets — use environment variables (GITHUB_TOKEN, ANTHROPIC_API_KEY)
• Review AI-generated output before applying changes to your codebase
• Protect .oak/ directory — it contains project configuration
• Use minimal token scopes and rotate API tokens regularly

Security patches are released as patch versions and announced via:

• GitHub Security Advisories
• GitHub Releases

• Vulnerability reports: security@goondocks.co (email only)
• General security questions: GitHub Discussions