Skills-Graph is currently in active early-stage development at the 0.x series. Security fixes are applied to the latest minor release on master.

Please do not open a public GitHub issue for security vulnerabilities. Instead:

1. Email security@synapticsolutions.ai with:
   • a description of the issue,
   • reproduction steps or a proof of concept,
   • the commit hash or release version you observed it on,
   • any suggested mitigations.
2. We will acknowledge receipt within 3 business days.
3. We aim to provide an initial assessment within 10 business days of acknowledgement.
4. Coordinated disclosure timelines are set jointly with the reporter on a per-issue basis. Default target: fix released within 90 days of confirmation.

If you would like the report encrypted, request our PGP key in your initial mail and we will reply with the public key block.

In scope:

• Code in this repository under src/, test/, and the root configuration files.
• Pipeline orchestrators and adapters maintained here.
• Default deployment topologies described in USER-GUIDE.md.

Out of scope:

• Third-party services consumed via adapter ports (OpenAI, DeerFlow, Onyx, Google ADK). Report those upstream.
• Vulnerabilities that require a malicious admin to already hold authority on the canonical graph -- the trust model in adrs/006-authority-records-and-review-queue-governance.md assumes admin authority is already trusted.
• Issues in third-party packages. Open the report against the upstream project; we will track mitigations here separately.

We are happy to credit researchers who responsibly disclose issues in the release notes of the fixing version. Let us know whether you prefer a name, handle, or anonymous credit when you report.