# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in this repository, please report it through
Carta's [Responsible Disclosure Policy](https://carta.com/security/responsible-disclosure-policy/).

You can also reach Carta's security team directly at **security@carta.com**.

Please do not open public GitHub issues for security vulnerabilities.

## About This Repository

This repository contains Claude Code plugin definitions and configuration (skills, hooks,
manifests). It does not contain the Carta MCP server or platform code. Security issues
related to the Carta platform, API, or MCP server should also be reported through the
[Responsible Disclosure Policy](https://carta.com/security/responsible-disclosure-policy/).
