Security and disclosure

Report a vulnerability

Email security@slashclone.dev (placeholder: the domain is not final and this mailbox is not monitored yet). Include what you found, steps to reproduce, and the impact you expect. Please do not open a public issue for security problems.

We will acknowledge your report within [3] business days, keep you updated, and credit you when we publish a fix if you would like. The machine-readable contact is at /.well-known/security.txt.

Safe harbor

We will not pursue or support legal action against good-faith research that follows these rules. [Lawyer to review safe harbor wording.]

• Test only against your own account and kits.
• Do not access, change, or delete other people's data.
• Do not degrade the service: no denial of service, spam, or automated scanning at volume.
• Give us reasonable time to fix an issue before you disclose it.

Malicious kits

If a kit in the library is harmful, use the report button on its page or file a takedown request with the reason "malware".

How kits are protected

• Every public version is scanned for secrets, dangerous commands, prompt injection, and behavior its manifest does not declare.
• Every published version is content-hashed and signed with the platform key. The CLI checks the hash and signature on install. Public keys are at /.well-known/slashclone-keys.json.
• On install, the CLI writes agent permission rules limited to what the kit declared.
• Versions are immutable. A fix is always a new version.

Key handling and rotation are documented in docs/SECURITY.md in the SlashClone repository.