From 32a433f294f31035275d9a158bd638ec3cecbc0f Mon Sep 17 00:00:00 2001
From: Ali Mohammad <freelancealimohammad@gmail.com>
Date: Tue, 20 Oct 2026 00:28:39 +0300
Subject: [PATCH] V40: Add a security policy

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 README.md     |  2 ++
 SECURITY.md   | 70 +++++++++++++++++++++++++++++++++++++++++++++++++++
 llms-full.txt |  2 ++
 package.json  |  3 ++-
 4 files changed, 76 insertions(+), 1 deletion(-)
 create mode 100644 SECURITY.md

diff --git a/README.md b/README.md
index 9a092dede..265f0fa88 100644
--- a/README.md
+++ b/README.md
@@ -354,6 +354,8 @@ Contributions are welcome: see [CONTRIBUTING.md](CONTRIBUTING.md) for setup and
 the checks a pull request must pass (`npm run typecheck`, `npm run lint`,
 `npm test`, `npm run test:coverage && npm run fallow`).
 
+To report a vulnerability, see [SECURITY.md](SECURITY.md).
+
 ## License
 
 MIT © [Lousho Team](LICENSE)
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 000000000..3de8b1815
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,70 @@
+# Security policy
+
+## Supported versions
+
+`@lousho/build-ai-agent` is in the 1.0.0 alpha line on npm. Until 1.0 ships,
+only the latest alpha release receives security fixes. If you are on an older
+alpha, upgrade before reporting, and confirm the issue still reproduces.
+
+| Version | Supported |
+| --- | --- |
+| Latest `1.0.0-alpha.*` | Yes |
+| Older alphas | No |
+
+## Reporting a vulnerability
+
+Please do not open a public issue, pull request or discussion for a security
+problem.
+
+Use GitHub private vulnerability reporting: open the repository's **Security**
+tab and choose **Report a vulnerability**, or go straight to
+<https://github.com/LinuxDevil/agent-sdk/security/advisories/new>.
+
+Please include:
+
+- the affected version (`npm ls @lousho/build-ai-agent`) and Node.js version;
+- the deployment target, if relevant (`node-server`, `docker`,
+  `cloudflare-worker`, or embedded in your own code);
+- a description of the impact: what an attacker can read, change or run;
+- the steps or a minimal reproduction, including any agent, route, auth or
+  approval configuration needed;
+- any suggested fix or mitigation you already know of.
+
+Do not include real credentials, API keys or customer data in a report.
+
+## What to expect
+
+This is a small, single-maintainer project, so these times are targets and not
+guarantees.
+
+- We acknowledge a report within 5 business days.
+- We aim to confirm or reject it, and tell you the outcome, within 15 business
+  days.
+- For a confirmed issue we prepare a fix and release it as a new alpha, then
+  publish a GitHub security advisory crediting the reporter unless you prefer
+  to stay anonymous.
+
+## Disclosure policy
+
+We practise coordinated disclosure. Please give us a reasonable chance to ship
+a fix before you share details publicly; 90 days from your report is the
+outer limit we ask for, and we will usually be faster. We will tell you before
+the advisory goes public.
+
+## Security model
+
+What the SDK does and does not protect you from is documented alongside the
+features it applies to:
+
+- [Route auth and principals](docs/auth.md): how HTTP routes are authenticated
+  and how callers map to principals.
+- [Workspace tools: security model](docs/workspace-tools.md#security-model):
+  what file and shell tools can reach, and the limits of the sandbox.
+- [Deployment](docs/deployment.md): hardening the HTTP API and the
+  `node-server`, `docker` and `cloudflare-worker` targets.
+- [Approvals](docs/approvals.md): gating sensitive tool calls behind a human
+  decision.
+
+Behaviour these pages describe as your responsibility (for example an agent you
+configured with shell access running a command you allowed) is usually not a
+vulnerability, but tell us if the docs are unclear.
diff --git a/llms-full.txt b/llms-full.txt
index ee6d4b2ce..a5376a5ae 100644
--- a/llms-full.txt
+++ b/llms-full.txt
@@ -351,6 +351,8 @@ Contributions are welcome: see [CONTRIBUTING.md](https://github.com/LinuxDevil/a
 the checks a pull request must pass (`npm run typecheck`, `npm run lint`,
 `npm test`, `npm run test:coverage && npm run fallow`).
 
+To report a vulnerability, see [SECURITY.md](https://github.com/LinuxDevil/agent-sdk/blob/main/SECURITY.md).
+
 ## License
 
 MIT © [Lousho Team](https://github.com/LinuxDevil/agent-sdk/blob/main/LICENSE)
diff --git a/package.json b/package.json
index 9b8ec66ff..cae3dcdae 100644
--- a/package.json
+++ b/package.json
@@ -298,7 +298,8 @@
     "docs/*.md",
     "LICENSE",
     "CHANGELOG.md",
-    "CONTRIBUTING.md"
+    "CONTRIBUTING.md",
+    "SECURITY.md"
   ],
   "sideEffects": [
     "./src/providers/index.ts",