We take the security of claude-base seriously. If you believe you have found a security vulnerability, please report it to us as described below.

Please do not report security vulnerabilities through public GitHub issues.

Instead, please report them via one of the following methods:

1. GitHub Security Advisories (Preferred)

   • Go to the Security tab
   • Click "Report a vulnerability"
   • Fill out the form with details

2. Email

   • Send an email to the maintainers
   • Include "SECURITY" in the subject line

Please include the following information in your report:

• Type of vulnerability (e.g., secret exposure, command injection, etc.)
• Full paths of source file(s) related to the vulnerability
• Location of the affected source code (tag/branch/commit or direct URL)
• Step-by-step instructions to reproduce the issue
• Proof-of-concept or exploit code (if possible)
• Impact of the issue, including how an attacker might exploit it

1. Acknowledgment: We will acknowledge receipt of your vulnerability report within 48 hours.

2. Communication: We will keep you informed of our progress throughout the investigation.

3. Credit: If you report a valid vulnerability, we will credit you in the security advisory (unless you prefer to remain anonymous).

4. No Legal Action: We will not pursue legal action against you if you:

   • Act in good faith
   • Avoid privacy violations, destruction of data, or service interruption
   • Give us reasonable time to address the issue before public disclosure

claude-base includes several security measures:

When using claude-base, follow these best practices:

• ✅ Keep the foundation updated to the latest version
• ✅ Review .claude/settings.json permissions for your needs
• ✅ Use CLAUDE.local.md for sensitive project-specific instructions
• ✅ Enable all pre-commit hooks
• ✅ Run npm audit regularly
• ✅ Review PRs that modify security-related files

• ❌ Commit .env files or secrets
• ❌ Disable gitleaks or pre-commit hooks
• ❌ Grant broad permissions in settings.json
• ❌ Skip security checks in CI
• ❌ Ignore Dependabot alerts

We follow a coordinated vulnerability disclosure process:

1. Reporter submits vulnerability
2. We confirm and assess severity
3. We develop and test a fix
4. We release the fix
5. We publish a security advisory
6. Reporter may publish their findings (after fix release)

Security updates are released as:

• Patch versions (x.x.X) for security fixes
• Security advisories on GitHub
• CHANGELOG.md entries marked with ### Security

Subscribe to GitHub notifications to receive security alerts.

Dependabot may show alerts on transitive dependencies of Docusaurus 3.10 (currently the latest stable) inside website/package-lock.json:

• uuid, dompurify, lodash, undici, picomatch, path-to-regexp, follow-redirects, brace-expansion, serialize-javascript, etc.

Risk assessment :

          bumps its internal dependencies in 3.11+ |

| Mitigation in this repo | Dependabot grouped updates for @docusaurus/* (one PR instead of 20) — see .github/dependabot.yml |

These alerts are common to all Docusaurus 3.10 sites (LangChain, NestJS, Tauri, Metabase, etc. exhibit the same alerts). They do not affect the runtime security of the foundation itself (commands, agents, skills, rules, scripts).

If a vulnerability with runtime impact on the foundation is reported, it will be triaged according to the severity table above and not waved off as a Docusaurus transitive.

For security-related questions that are not vulnerabilities:

• Open a GitHub Discussion
• Tag your question with "security"

Thank you for helping keep claude-base and its users safe!