# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in `aria-agentkit`, please report it responsibly.

**Do not open a public GitHub issue for security vulnerabilities.**

Instead, email us at: **security@empowerid.com**

We will acknowledge your report within 48 hours and provide a timeline for a fix.

## Supported Versions

| Version | Supported |
|---|---|
| 0.1.x | Yes |

## Security Design Principles

- **Fail-closed**: Policy evaluation errors result in denial, not permissive fallback.
- **No credential storage**: Tokens are passed at construction time; this package does not persist credentials.
- **Audit integrity**: Hash-chained receipts provide tamper-evident audit trails.
- **Sensitive data redaction**: Configurable redaction of sensitive fields before audit persistence.
- **HTTPS enforcement**: The underlying `authzen-policy-backend` enforces HTTPS for PDP communication in production (HTTP allowed only for localhost development).
