shard
Star 2
Fork 0
Watch
shard SECURITY.md
1.3 kB · 21 lines
Markdown
at main

Security policy #

Supported versions #

Shard is pre-release software. Security fixes are made on the latest main branch only.

Reporting a vulnerability #

Do not open a public issue for vulnerabilities involving authentication, permission bypasses, command execution, secret exposure, cross-origin access, or remote daemon access.

Use the repository host's private vulnerability-reporting feature once it is enabled. If private reporting is unavailable, contact the repository owner through a private channel listed on their profile. Include a minimal reproduction, impact, affected commit, and any suggested mitigation. Do not include live credentials or private session transcripts.

Operational guidance #

  • The daemon binds to loopback by default; keep that default unless remote access is intentional.
  • Prefer SSH forwarding or a TLS-terminating reverse proxy for remote access.
  • Never expose plaintext remote mode to an untrusted network.
  • Treat project-local instructions, skills, rules, agent definitions, and extensions as code or policy that requires review before trust.
  • Keep provider credentials in environment variables, not configuration files or the repository.

See WEB-DEPLOYMENT.md, PROTOCOL.md §4.1, and ARCHITECTURE.md §14 for the current security model.