Evan Hu
a8b7c9d08b
Community docs: - CODE_OF_CONDUCT.md (Contributor Covenant v2.1) - SECURITY.md (vulnerability reporting policy) - CHANGELOG.md (initial release notes) - CODEOWNERS (per-type review ownership) GitHub config: - Issue templates: bug-report, pricing-correction, documentation - FUNDING.yml (GitHub Sponsors) Validation enhancements: - Cross-reference check: hand [[requires]] → integration existence - Routing alias collisions as warnings (errors with --strict) - --strict flag to promote warnings to errors - --type filter to validate single content type - CI: add taplo format check and lychee link check jobs Developer experience: - Makefile with validate, fmt, and scaffold targets - Scaffold templates for all 5 content types - .pre-commit-config.yaml (trailing whitespace, TOML check, validate) - docs/content-guide.md (naming, descriptions, prompts, decision guide) Content quality: - schema.toml: add last_verified field for model pricing - CONTRIBUTING.md: add pricing verification guide with source links
913 B
913 B
Security Policy
Scope
This repository contains TOML content definitions (agents, hands, integrations, skills, plugins, providers). Security concerns include:
- Malicious content in system prompts or descriptions
- Command injection in integration transport commands
- Integration URLs pointing to phishing or malicious sites
- Credential exposure in TOML files
Reporting a Vulnerability
Do NOT open a public issue for security vulnerabilities.
Email security@librefang.dev with:
- Description of the vulnerability
- Affected file(s) and content type
- Steps to reproduce or exploit
- Suggested fix (if any)
Response Timeline
- Acknowledgment: within 48 hours
- Assessment: within 5 business days
- Fix: dependent on severity, typically within 2 weeks
Supported Versions
| Version | Supported |
|---|---|
| main branch | Yes |
| Other branches | No |