# Security Policy

## Reporting

Please report suspected security issues privately to the repository owner instead of filing a
public issue.

Include:

- a description of the issue
- impact and affected surfaces
- steps to reproduce
- any proposed mitigation

## Scope

Security-sensitive areas for Cellin are expected to include:

- plugin loading and execution
- multimodal artifact ingestion
- prompt and model-provider boundaries
- data persistence and provenance integrity
