docs: add security policy

2026-07-14 12:42:56 +01:00
parent 3cfe36db0b
commit 6158714acf
1 changed files with 18 additions and 0 deletions
@@ -0,0 +1,18 @@
+# Security Policy
+
+## Supported Versions
+
+Only the latest published version of `pi-perplexity` receives security fixes.
+
+## Reporting a Vulnerability
+
+Please **do not** open a public issue for security vulnerabilities.
+
+Instead, report privately via [GitHub private vulnerability reporting](https://github.com/ivanrvpereira/pi-perplexity/security/advisories/new).
+
+You can expect an initial response within a week. Please include steps to reproduce and the impact you believe the issue has.
+
+## Scope Notes
+
+- This extension talks to an undocumented Perplexity endpoint and stores auth tokens at `~/.config/pi-perplexity/auth.json` (mode `0600`). Issues around token handling or storage are in scope.
+- The package is published to npm via GitHub Actions OIDC trusted publishing; no long-lived publish tokens exist.