# Security Policy

## Supported versions

This project is at an early stage. Only the latest release receives fixes.

## Reporting a vulnerability

Please do not open a public issue. Use [GitHub private vulnerability reporting](https://docs.github.com/en/code-security/security-advisories/guidance-on-reporting-and-writing-information-about-security-vulnerabilities/privately-reporting-a-security-vulnerability) on this repository, or email syncaissa@outlook.com.

Include what you found, how to reproduce it, and its likely impact. We aim to reply within 7 days.

## Especially important

Reports in these areas matter most, because the design depends on them:

- A model or plain-language request causing a state change without approval
- Data leaving above a recipient's clearance
- Injection through custom definitions
- Bypassing the gate, guards or interlocks
- Forged or accepted-when-invalid access tokens

## Not for safety functions

HEART Core must not be part of a safety function or a real-time control loop. See Section 15 of the API Standard.