# Security policy

Canonical: https://docs.shumoku.dev/ja/project/security
Language: ja

SECURITY.md

# Security policy

How to report a security vulnerability responsibly.

この文書の日本語版はまだありません。原文を表示しています。

We take the security of Shumoku seriously and appreciate responsible disclosure.

## Reporting a vulnerability

**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**

Instead, report privately through either of these channels:

*   **GitHub Security Advisory (preferred):** [open a private advisory](https://github.com/konoe-akitoshi/shumoku/security/advisories/new).
*   **Email:** [contact@shumoku.dev](mailto:contact@shumoku.dev).

### What to include

To help us understand and reproduce the issue, please include as much of the following as you can:

*   **Impact** — what an attacker can achieve, and which component is affected (library, CLI, Server, Editor, or a specific plugin).
*   **Affected versions** — the version(s) where you observed the issue.
*   **Steps to reproduce** — a minimal, reliable reproduction.
*   **Proof of concept** — a brief summary or snippet, if you have one.
*   **Suggested fix or mitigation** — optional, but welcome.

## What to expect

*   We will acknowledge your report and investigate it as our time and resources allow, and work with you on a fix and coordinated disclosure.
*   Shumoku is an early-stage open-source project. **There is currently no commercial SLA or guaranteed response time.** We will do our best on a best-effort basis.
*   We ask that you give us a reasonable opportunity to address the issue before any public disclosure, and that you avoid accessing or modifying other users’ data while researching.

## Supported versions

Security fixes are generally applied to the latest released version. Older versions are addressed on a best-effort basis only. We recommend always running a current release.

## No warranty

Shumoku is free and open-source software provided under the **AGPL-3.0** license, **as-is and without warranty of any kind**, as described in the [LICENSE](https://github.com/konoe-akitoshi/shumoku/blob/73ebc72ba0bc0d1caf74e1ed34c89a6debcb0e6a/LICENSE). Reporting a vulnerability does not create any warranty, support obligation, or service-level commitment. We are nonetheless grateful for responsible disclosure and will work with reporters in good faith.