If you discover a security vulnerability in @emisso/security, please report it responsibly:

1. Do NOT open a public issue.
2. Email security@emisso.ai with details of the vulnerability.
3. Include steps to reproduce and potential impact.
4. We will acknowledge receipt within 48 hours and provide a timeline for a fix.

This policy covers the @emisso/security SDK, CLI, and GitHub Action.

• Provider credentials — API keys passed to providers (Claude, Codex) are never logged or persisted.
• SARIF output — May contain code snippets from scanned repositories. Treat SARIF files as sensitive.
• Rule execution — Rules are markdown files parsed locally. Custom rules are not executed as code.
• CLI arguments — API keys should be passed via environment variables, not CLI flags.