The TorusGuard project takes security seriously. If you believe you have discovered a vulnerability or security flaw in TorusGuard itself (such as unsafe skill instructions, template flaws, or repository infrastructure), please report it responsibly and privately.

Do not file public GitHub issues, discussions, or pull requests for undisclosed security vulnerabilities.

Note on Third-Party Applications & Educational Fixtures:

• External Codebases: TorusGuard is an open-source guidance framework. If you find a security vulnerability in an application audited with TorusGuard, please report it directly to the maintainers of that application following their private disclosure policy.
• Educational Fixtures: Files located in examples/vulnerable-*/, examples/python/*-vuln/, and tests/fixtures/*/ are intentionally vulnerable educational fixtures. They are deliberately insecure by design for validation purposes and must never be deployed to production.

1. Preferred Method: Use GitHub Private Vulnerability Reporting.
2. Alternative Method: Contact the project maintainer directly via GitHub (@githubmofo / Jenish Lad).

Please provide:

• A clear description of the issue.
• Affected files, guides, templates, or rule identifiers.
• Step-by-step reproduction instructions or code snippet.
• Assessment of potential security impact.
• Any suggested remediations or mitigations.

• Initial Acknowledgment / Triage: Within 48 to 72 hours.
• Status Update & Remediation Plan: Within 7 days of initial triage.
• Coordinated Disclosure: We adhere to standard coordinated disclosure principles. Once a fix is verified and released, a public security advisory will be published crediting the researcher (unless anonymity is requested).

In alignment with OWASP and NIST vulnerability disclosure guidelines:

• Security testing against TorusGuard must be non-destructive and limited to repository source code, templates, and portable skill definitions.
• Probing or scanning live infrastructure, production accounts, or external services is strictly out of scope.

Security updates and patches are prioritized for the current active release line: