ForgeFlow/SECURITY.md

Security policy

ForgeFlow can interact with local Git repositories, Gitea, update metadata and controlled deployment targets. Security-sensitive behavior is documented in docs/SECURITY.md.

Report vulnerabilities privately to the repository owner when disclosure could expose credentials, signing material, repository access details or deployment infrastructure.

Never commit Gitea tokens, SSH private keys, release-signing private keys, deployment credentials or local repository state. The packaged signing public key is intentionally public; private signing material must remain outside Git.