# Security Policy

## Reporting a Vulnerability

If you discover a security vulnerability in this plugin, please report it responsibly.

**Do NOT open a public issue for security vulnerabilities.**

Report privately to <security@fromaitochitta.com>.
Canonical repository: https://git.fromaitochitta.com/open/linkedin-studio

Please include the affected version or commit, a minimal reproduction, and the
impact you see. We acknowledge every report within 5 working days, agree a
fix and disclosure timeline with the reporter, and aim to disclose within 90
days of the initial report.

## Supported versions

| Version | Supported |
| ------- | --------- |
| 0.8.x   | :white_check_mark: |
| < 0.8   | :x:       |

This plugin has not reached 1.0 yet: it is a single, continuous 0.x
release line (no parallel maintenance branches), and only the latest
0.x release receives security fixes — there are no backports to older
0.x versions. See `CHANGELOG.md` for release history.

## Security Considerations

This plugin:

- Does not store credentials or API keys
- Does not make external network requests (except when using WebFetch for URL processing)
- Does not execute arbitrary code
- Stores all data locally in markdown files

## User Data

- The `config/user-profile.local.md` file contains personal preferences
- This file is gitignored by default to prevent accidental commits
- Review your `.gitignore` before pushing to ensure no personal data is committed

## Dependencies

This plugin has no external dependencies beyond Claude Code itself.