# Security Policy

## Supported Versions

| Version | Supported |
|---------|-----------|
| 2.x.x | Yes |
| 1.x.x | Until 2027-01-01 |
| < 1.0 | No |

## Reporting a Vulnerability

Found a security issue? Thanks for helping keep this project safe.

### What counts as a security issue?

- Malicious prompts in skills that could manipulate AI output harmfully
- Skills that leak sensitive data (API keys, secrets, credentials) in examples
- Install scripts that execute arbitrary code
- Dependencies with known vulnerabilities

### What does NOT count?

- AI output quality issues (use GitHub Issues)
- Skill accuracy / benchmark concerns (use GitHub Issues)
- Feature requests (use GitHub Issues)

### How to report

**Do NOT open a public issue.** Instead:

1. Email: security@opa.business (or contact repo owner privately)
2. Subject: `[SECURITY] ai-business-skills — <brief description>`
3. Include:
   - Description of the issue
   - Steps to reproduce
   - Potential impact
   - Suggested fix (if known)

### What to expect

- **48 hours:** Initial acknowledgement
- **7 days:** Assessment + severity rating
- **30 days:** Fix or mitigation plan
- **60 days:** Public disclosure (after fix)

### Credit

Reporters will be credited in the CHANGELOG (unless you prefer to remain anonymous).

## Security Best Practices for Users

When using these skills:

1. **Review skill output before executing code.** Never blindly run scripts generated by AI.
2. **Keep secrets out of skill prompts.** Don't paste API keys or passwords into AI conversations.
3. **Review install scripts before running.** `./install.sh` only copies files, but always verify.
4. **Use version pinning.** For production use, pin to a specific version (e.g., `v2.0.0`) rather than `master`.

## Dependencies

This project has **zero runtime dependencies** — skills are pure markdown. Install scripts use only standard shell / PowerShell commands.

Validation scripts use bash and PowerShell built-ins only. No external packages required.
