mirror of
https://github.com/instructkr/claw-code.git
synced 2026-10-19 00:00:08 +08:00
Bellmanandclawdbot
6d6c83be01
- Updated SECURITY.md with explicit instructions for reporting vulnerabilities via GitHub Security Advisories - Replaced 'when available' qualifier since Private Vulnerability Reporting is now enabled - Provided step-by-step guidance for security researchers to submit vulnerability reports Co-authored-by: clawdbot <clawdbot@ultraworkers.dev>
56 lines
1.9 KiB
Markdown
56 lines
1.9 KiB
Markdown
# Security Policy
|
|
|
|
## Supported versions
|
|
|
|
Security fixes target the current `main` branch and the latest published
|
|
release artifacts when available. Older experimental branches are not supported
|
|
unless a maintainer explicitly marks them as supported.
|
|
|
|
## Reporting a vulnerability
|
|
|
|
Please do **not** open a public issue for a suspected vulnerability. Use [GitHub
|
|
Security Advisories](https://docs.github.com/en/code-security/security-advisories)
|
|
for `ultraworkers/claw-code`:
|
|
|
|
1. Go to the **Security** tab of this repository
|
|
2. Click **"Report a vulnerability"**
|
|
3. Describe the issue with reproduction steps and impact
|
|
|
|
Alternatively, contact a maintainer through the repository's published support
|
|
channel with a minimal, non-destructive reproduction.
|
|
|
|
Include:
|
|
|
|
- affected command, crate, or workflow;
|
|
- operating system and shell, especially for Windows/PowerShell path issues;
|
|
- whether live credentials, MCP servers, plugins, or workspace filesystem
|
|
access are involved;
|
|
- expected impact and any safe proof-of-concept steps.
|
|
|
|
Do not include real API keys, private prompts, session transcripts with secrets,
|
|
or exploit payloads that modify third-party systems.
|
|
|
|
## Scope
|
|
|
|
In scope:
|
|
|
|
- workspace path traversal or symlink escapes;
|
|
- permission bypasses, sandbox misreporting, or unsafe tool execution;
|
|
- credential disclosure in logs, JSON output, telemetry, docs, or examples;
|
|
- plugin, hook, MCP, provider, or config behavior that can unexpectedly execute
|
|
code or leak secrets.
|
|
|
|
Out of scope:
|
|
|
|
- social engineering;
|
|
- denial-of-service without a practical security impact;
|
|
- issues that require already-compromised local developer credentials;
|
|
- reports against third-party providers or upstream tools without a Claw Code
|
|
integration issue.
|
|
|
|
## Handling expectations
|
|
|
|
Maintainers will acknowledge valid private reports as soon as practical, keep
|
|
discussion private until a fix or mitigation is available, and credit reporters
|
|
when requested and appropriate.
|