Bearing Lite is currently a pre-1.0 project. Security fixes are provided for the current main branch and the latest published 0.1.x release of @alphazede/bearing-lite, when one is available. Older commits, development snapshots, and superseded releases are not supported unless a published advisory says otherwise.

Use GitHub's private vulnerability reporting form. Private vulnerability reporting is enabled for this repository when the host supports it.

Do not open a public issue, discussion, pull request, or social-media post for a suspected vulnerability. Use public issues only for ordinary, non-security bugs.

Include enough information to reproduce and assess the problem:

• The affected Bearing Lite version or commit.
• Operating system, installation method, and agent client.
• A minimal reproduction, proof of concept, and observed impact.
• Whether owner authority, repository boundaries, skill routing, or hook integrity behavior was bypassed or misreported.
• Suggested mitigations, if known.

Use synthetic data whenever possible. Do not send credentials, customer data, private repository contents, raw agent-session history, or unredacted evidence. If a secret may have been exposed, revoke or rotate it before reporting and include only a redacted identifier.

Reports are especially useful when they involve:

• Skill or hook behavior that expands authority, skips required assurance, or claims executable enforcement the client cannot provide.
• Path traversal, unsafe file mutation guidance, or repository-boundary mistakes in packaged skills or hooks.
• Sensitive data leaking through logs, packaged files, diagnostics, or npm package contents.
• Release, dependency, build, or package-publishing integrity.
• Model, provider, or credential handling introduced into public product surfaces (Bearing Lite must remain provider-neutral and must not ship credentials or secret lookup paths).

A weakness in a third-party agent client, model provider, runtime, or dependency should normally be reported to that project. Report it to Bearing Lite as well when this package exposes, amplifies, or incorrectly handles the weakness.

GitHub immediately records the private report. AlphaZede aims to:

• Acknowledge the report within three business days.
• Provide an initial triage result within seven calendar days.
• Send an update at least every fourteen calendar days while remediation is active.
• Coordinate a fix, release, and public advisory before public disclosure when the report is confirmed.

These are response targets, not a support SLA. Timing may change with severity, reproduction quality, upstream dependencies, and release risk. Reporters who want public credit should request it in the private advisory. Duplicate, non-security, or unsupported reports will be closed with an explanation.

Research must avoid privacy violations, service disruption, persistence, social engineering, and access to data or repositories you do not own or have permission to test. Use the minimum access necessary, stop when sensitive data is encountered, and report promptly through the private channel.

AlphaZede will not initiate legal action for accidental, good-faith violations of this policy when the researcher promptly stops, reports the issue, avoids harm, and gives reasonable time for remediation. This policy cannot authorize testing of third-party systems or excuse violations of applicable law.

Bearing Lite does not currently offer a bug bounty or promise compensation.