# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 2.1.x   | Yes       |
| < 2.1   | No        |

## Reporting a Vulnerability

If you discover a security vulnerability in AIPass, please report it responsibly.

**Do not open a public GitHub issue for security vulnerabilities.**

Instead, use one of these methods:

1. **GitHub Security Advisories** (preferred): [Report a vulnerability](https://github.com/AIOSAI/AIPass/security/advisories/new)
2. **Email**: aipass.system@gmail.com

### What to include

- Description of the vulnerability
- Steps to reproduce
- Affected version(s)
- Any potential impact

### What to expect

- Acknowledgment within 48 hours
- Status update within 7 days
- Fix timeline communicated once the issue is confirmed

## Scope

### In scope

- AIPass Python package (`src/aipass/`)
- CLI entry points (`drone`, `aipass`)
- Hook scripts (`.claude/hooks/`)
- GitHub Actions workflows (`.github/workflows/`)

### Out of scope

- Third-party dependencies (report upstream)
- Issues requiring physical access to the machine
- Social engineering

## Security Design

AIPass runs locally. No data leaves your machine unless you explicitly configure external services.

- **Secrets** are stored outside the repo at `~/.secrets/aipass/` and never committed
- **API keys** are handled by the `api` branch and never logged or exposed in output
- **Git operations** are sandboxed through `drone @git` with permission deny lists
- **Hook scripts** run in the Claude Code sandbox environment
