# Security policy

ScopeWrit is a public alpha. Please report suspected vulnerabilities privately
to [justin@cyberelf.link](mailto:justin@cyberelf.link) with:

- the affected version or commit;
- the manifest and adapter class involved;
- a minimal reproduction;
- the effect that occurred or could occur;
- whether public disclosure is already underway.

Do not test against systems or data you do not own or have permission to use.
The repository benchmark is isolated and is the preferred reproduction surface.

Security boundaries and known exclusions are documented in
[`docs/THREAT_MODEL.md`](docs/THREAT_MODEL.md).
