# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in agent-dashboard, please report it responsibly.

**Do not open a public issue.** Instead, use one of the following:

- **GitHub Security Advisories:** [Report a vulnerability](https://github.com/bjornjee/agent-dashboard/security/advisories/new)
- **Email:** Open a private advisory on GitHub (preferred)

## What to Include

- Description of the vulnerability
- Steps to reproduce
- Potential impact
- Suggested fix (if any)

## Response Timeline

- **Acknowledgment:** within 3 business days
- **Initial assessment:** within 7 business days
- **Fix or mitigation:** best effort, depending on severity

## Scope

This policy covers the agent-dashboard binary and its direct dependencies. It does not cover:

- Third-party tools (tmux, Claude Code, Node.js)
- User-configured environment variables or shell profiles
- Operating system–level security
