36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
# Security Policy
|
|
|
|
## Supported Versions
|
|
|
|
Only the latest released version of `ui-ux-pro-max-cli` and the latest `main` branch of this skill receive security fixes.
|
|
|
|
| Version | Supported |
|
|
|---------|-----------|
|
|
| Latest release | ✅ |
|
|
| Older releases | ❌ |
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
Please **do not** open a public GitHub issue for security vulnerabilities.
|
|
|
|
Instead, report it privately using [GitHub's private vulnerability reporting](https://github.com/nextlevelbuilder/ui-ux-pro-max-skill/security/advisories/new) (Security tab → "Report a vulnerability").
|
|
|
|
Include as much of the following as possible:
|
|
|
|
- A description of the vulnerability and its potential impact
|
|
- Steps to reproduce (command, prompt, or CLI flags used)
|
|
- The version of `ui-ux-pro-max-cli` and the AI assistant/platform involved
|
|
- Any relevant logs or output
|
|
|
|
We aim to acknowledge reports within 5 business days and to provide a fix or mitigation timeline within 14 days for confirmed issues.
|
|
|
|
## Scope
|
|
|
|
This project is a design-system generation skill: a Python search/CLI tool and static data (CSV/JSON) consumed by AI coding assistants. In-scope concerns include:
|
|
|
|
- Arbitrary code execution via the CLI installer or search scripts
|
|
- Path traversal or unsafe file writes when running `uipro init` / `uipro uninstall`
|
|
- Supply-chain issues in the `ui-ux-pro-max-cli` npm package or its release pipeline
|
|
|
|
Out of scope: the design output itself (colors, fonts, UI recommendations) is not a security surface.
|