We provide security updates for the latest minor version of the 1.x release line.

Do not open a public issue for suspected vulnerabilities.

Use GitHub Security Advisories to submit a private report. Include:

• Affected version or commit
• Reproduction steps
• Expected security impact
• Suggested mitigation, if known

Do not include real credentials or unrelated private data.

When using PromptScript in your organization:

• Use private Git registries for sensitive configurations
• Authenticate with tokens stored in environment variables
• Review registry changes through pull requests

• Validate .prs files in CI pipelines before merging
• Use prs validate --strict to catch issues early
• Pin registry versions for production stability

• Never hardcode credentials in .prs files
• Use environment variable substitution: ${PUBLIC_KEY}
• Keep .env files out of version control

This security policy applies to:

• The @promptscript/cli npm package
• The PromptScript Docker images
• The PromptScript GitHub repository

Third-party packages, plugins, or external registries are not covered by this policy.

Security advisories are published via:

• GitHub Security Advisories
• Release notes in CHANGELOG.md

Subscribe to the repository's security alerts to be notified of new advisories.