This project is in an early public-release stage. Security fixes are applied to the latest revision on the default branch. Older revisions and unmaintained forks are not supported.
Use GitHub's private Report a vulnerability flow for this repository. Maintainers must enable private vulnerability reporting before the first public release. If that flow is unavailable, open only a non-sensitive issue asking for a private contact channel; do not disclose the vulnerability or any private work content in the issue.
Include:
- A concise description of the issue and its impact.
- The affected revision and Python version.
- Minimal reproduction steps using synthetic data.
- A suggested mitigation, if known.
Remove private records and secrets from logs, screenshots, archives, and sample repositories before submitting them. Reports are reviewed on a best-effort basis; no response-time commitment is currently offered.
An initialized work repository may contain sensitive professional history even when it contains no credentials. Keep it separate from the skill source, restrict access, and review backup and publication settings.
The project produces plain Markdown and configuration files. It does not encrypt stored content, manage device access, or replace a secrets manager. Never store passwords, private keys, session credentials, recovery codes, or similar authentication material in a work record.
If a secret is accidentally recorded or committed:
- Revoke or rotate it immediately.
- Remove it from the canonical record and every derived file.
- Purge it from repository history and cached artifacts where applicable.
- Review access logs and sharing settings.
The included Python helpers use the standard library. Contributions that add a dependency should explain why it is needed, pin it appropriately, and include a review of its maintenance and security posture.