Security fixes are applied to the latest released minor version until the project reaches 1.0.0. After 1.0.0, the latest major version and the immediately previous major version will receive security fixes when practical.

Do not open a public issue for an unpatched vulnerability. Use the repository's Security tab and choose Report a vulnerability to submit a private GitHub Security Advisory.

Include:

• Affected version or commit.
• Reproduction steps or a minimal malicious skill.
• Expected and observed behavior.
• Security impact and any known workaround.

Please allow maintainers time to validate and coordinate a fix before public disclosure.

SkillConform uses static heuristics and policy checks. A clean report is not a security certification. Run untrusted skills only with appropriate sandboxing, least-privilege tool permissions, and human review.