Kjell Tore Guttormsen
66fd00c005
Repo is on Forgejo, not GitHub — the disclosure path had no email/URL and pointed to a feature that doesn't exist here. Adds security@fromaitochitta.com, the https:// canonical-repo URL, and an explicit acknowledge/fix/disclosure timeline. Existing prose (Security Considerations / User Data / Dependencies) kept as-is. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01XpHNahaWWf1gX1FoAxuBFV
34 lines
1.1 KiB
Markdown
34 lines
1.1 KiB
Markdown
# Security Policy
|
|
|
|
## Reporting a Vulnerability
|
|
|
|
If you discover a security vulnerability in this plugin, please report it responsibly.
|
|
|
|
**Do NOT open a public issue for security vulnerabilities.**
|
|
|
|
Report privately to <security@fromaitochitta.com>.
|
|
Canonical repository: https://git.fromaitochitta.com/open/linkedin-studio
|
|
|
|
Please include the affected version or commit, a minimal reproduction, and the
|
|
impact you see. We acknowledge every report within 5 working days, agree a
|
|
fix and disclosure timeline with the reporter, and aim to disclose within 90
|
|
days of the initial report.
|
|
|
|
## Security Considerations
|
|
|
|
This plugin:
|
|
|
|
- Does not store credentials or API keys
|
|
- Does not make external network requests (except when using WebFetch for URL processing)
|
|
- Does not execute arbitrary code
|
|
- Stores all data locally in markdown files
|
|
|
|
## User Data
|
|
|
|
- The `config/user-profile.local.md` file contains personal preferences
|
|
- This file is gitignored by default to prevent accidental commits
|
|
- Review your `.gitignore` before pushing to ensure no personal data is committed
|
|
|
|
## Dependencies
|
|
|
|
This plugin has no external dependencies beyond Claude Code itself.
|