# Security Policy

## Supported Versions

| Version | Supported          |
| ------- | ------------------ |
| 0.4.x   | Yes                |
| 0.3.x   | Yes                |
| < 0.3   | No                 |

## Reporting a Vulnerability

If you discover a security vulnerability in agentsec, please report it responsibly through **GitHub's private security advisory** feature:

1. Go to the [Security tab](https://github.com/debu-sinha/agentsec/security/advisories) of this repository
2. Click "Report a vulnerability"
3. Provide a clear description of the issue, steps to reproduce, and potential impact

**Do not open a public issue for security vulnerabilities.**

## What to Expect

- Acknowledgment within 48 hours
- Initial assessment within 5 business days
- A fix or mitigation plan within 30 days for confirmed vulnerabilities
- Credit in the release notes (unless you prefer to remain anonymous)

## Scope

This policy covers the `agentsec-ai` Python package and its dependencies. It includes:

- Scanner logic (installation, skill, MCP, credential scanners)
- Hardening profiles and configuration generation
- CLI commands and output reporters
- Secret detection and sanitization

## Responsible Disclosure

We follow coordinated disclosure. Please allow reasonable time for a fix before public disclosure.
