# Security policy

## Supported versions

Shard is pre-release software. Security fixes are made on the latest `main` branch only.

## Reporting a vulnerability

Do not open a public issue for vulnerabilities involving authentication, permission bypasses, command execution, secret exposure, cross-origin access, or remote daemon access.

Use the repository host's private vulnerability-reporting feature once it is enabled. If private reporting is unavailable, contact the repository owner through a private channel listed on their profile. Include a minimal reproduction, impact, affected commit, and any suggested mitigation. Do not include live credentials or private session transcripts.

## Operational guidance

- The daemon binds to loopback by default; keep that default unless remote access is intentional.
- Prefer SSH forwarding or a TLS-terminating reverse proxy for remote access.
- Never expose plaintext remote mode to an untrusted network.
- Treat project-local instructions, skills, rules, agent definitions, and extensions as code or policy that requires review before trust.
- Keep provider credentials in environment variables, not configuration files or the repository.

See `WEB-DEPLOYMENT.md`, `PROTOCOL.md` §4.1, and `ARCHITECTURE.md` §14 for the current security model.