If you discover a security vulnerability in the Skill Engineering Stack, we appreciate your responsible disclosure.
We take security seriously. If you find a security issue, please follow these steps:
Do not open a public issue or discuss the vulnerability publicly until it has been addressed.
Contact the maintainers privately:
- Email: forsythe@github.com
- Preferred method: Encrypted email using the maintainer's PGP key (if available)
Please include the following information:
| Field | Description |
|---|---|
| Description | A clear description of the vulnerability |
| Affected Component | Which part of the system is affected |
| Steps to Reproduce | How to trigger the vulnerability |
| Potential Impact | What an attacker could achieve |
| Suggested Fix | (Optional) Your proposed remediation |
We commit to:
- Acknowledging receipt of your report within 48 hours
- Investigating the vulnerability within 7 days
- Providing a timeline for the fix
- Thanking you in our release notes (if you wish)
| Area | Risk | Mitigation |
|---|---|---|
| Provenance Tampering | Artifact substitution between passes | input_hash verification on resume (§8 Resume Invariant) |
| Self-Grading Injection | A context grading its own output | Blinding protocol (§3.5) and isolation requirements (§5) |
| Bait Grading Conflict | Same context generates and grades bait | Two-role separation (Pass 7.5, §9 Rule 9) |
| Consolidation Audit | Misreporting in FULL_REPORT.md | Independent auditor cross-check (§8.x) |
| Archive Manipulation | Altered evolution history | Source hash verification and lineage integrity checks |
| Area | Recommendation |
|---|---|
| Dependencies | Monitor with Dependabot |
| CI/CD | GitHub Actions with branch protection |
| Secrets | Never commit secrets; use GitHub Secrets for CI |
| Access | Least-privilege principle for collaborators |
| Version | Status |
|---|---|
| 5.5 | ✅ Current (actively maintained) |
| 5.4 | |
| <5.4 | ❌ No longer supported |
- Security issues: Private email to maintainers
- General questions: GitHub Discussions (when available)
- Bug reports: GitHub Issues
- Feature requests: GitHub Issues with
enhancementlabel
Skill Engineering Stack v5.5 — Security Policy
Responsible disclosure. Verified artifacts only.